24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T50e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SmileMotion — Falcon Sandbox Report — Score 51/100 — Sample 15c01f65d8db…","description":"Malicious verdict for sandbox report 6508440d23e3…. Malware family: SmileMotion. Threat score 51/100. 0 malicious and 9 suspicious behavioral indicators across 120 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5/6508440d23e336997707082c","keywords":["Malicious","SmileMotion","sandbox report","malware analysis","MITRE ATT\u0026CK","15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5"],"about":{"@type":"SoftwareApplication","name":"DownloadHelperTray.exe","applicationCategory":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","identifier":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","additionalType":"Malicious sample"},"threatScore":51,"malwareFamily":"SmileMotion","sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":0,"suspicious":9,"totalSignatures":120},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T19fd,Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "DownloadHelperTray") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "DownloadHelperTray") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "DownloadHelperTray") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "DownloadHelperTray") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "DownloadHelperTray") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "DownloadHelperTray") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "DownloadHelperTray") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "DownloadHelperTray") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "DownloadHelperTray") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "DownloadHelperTray") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "DownloadHelperTray") Found reference to "(GlobalSign Timestamping CA - SHA384 - G40" (Indicator: "SHA384"; File: "DownloadHelperTray") Found reference to "(GlobalSign Timestamping CA - SHA384 - G4" (Indicator: "SHA384"; File: "DownloadHelperTray") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "DownloadHelperTray") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "DownloadHelperTray") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp")26:T560,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys27:Tc88,"DownloadHelperTray.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000002fb91fb123254273e0221c00687d0c7580f11c0030544273b34847c2feffffff9cf01c00b240417340f01c000000237438f11c00cb404173e0df3a7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c8f01c00000000000800000000000000000000000000000000000000000000000000237407b91fb10000000008f11c006992e873ffffffff34000000c8f01c0008000000000000000000237438f11c002794e873d0f01c000b0000000000000020f11c00 (UID: 00000000-00002096) "DownloadHelperTray.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096) "DownloadHelperTray.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096) "DownloadHelperTray.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a0de1c0044de1c00226e047500004804000000002d6e0475792028ae2d000000ecb7af75c8de1c0000004f02b8e96402b0256402160000008000000008de1c0000004f028cde1c0070c80575c58f3edbfeffffff2d000000d0ccbe75270000005cde1c00856a06751c230b759cde1c00f85f067508000000bb690575b2690575a12028ae2d000000ecb7af7527000000d0ccbe7570de1c002d000000d0ccbe7527000000a0de1c00856a06751c230b75e8de1c007e8abd75ee8cbd75738abd75c89be1d82d000000ecb7af7527000000d0ccbe75e428480478284804c89be1d8b0de1c00fc52fb759cdf1c00e084bd7518b404adfeffffff738abd75 (UID: 00000000-00002096) "DownloadHelperTray.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000bb70187dbb7000000000d0a9b0730000a9739011aa7340e46302d8b75f02b81b6602c0e81c00feffffff68eb1c00506a097747bd852cfeffffff80e91c00eaa9057740e4630200000000b81b6602a11400000a000b00b297bb705c76bb706876bb70b81b66026860660214000000000000000000000040e46302a8e91c00cc2d0a77b81b660200000000c41b660200000000f800b47000000000cc0d24385ce80877684007779003000019000000110000001000000028bc5e02e0e91c008d9a9b7348b95e02745965020000000000ea1c0004bc5e027459650218ea1c000000b470feffffff0400000020af9b7300000000000000000300000008ea1c00 (UID: 00000000-00002096)28:T79c,Found reference to API "FindWindowEx" (Indicator: "FindWindow"; File: "DownloadHelperTray") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "DownloadHelperTray") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; File: "DownloadHelperTray") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "DownloadHelperTray") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "DownloadHelperTray") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API "10707607530,2656,109,,GetWindowTextW,user32.dll,"00:18:06.328",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp")29:T94f,"SELECT last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch'),url,title FROM urls ORDER BY last_visit_time DESC LIMIT 5;" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch') url title from urls order by last_visit_time desc limit 5;"), "SELECT last_visit_date datetime(last_visit_date / 1000000, 'unixepoch') url title FROM moz_places ORDER BY last_visit_date DESC LIMIT 5;" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select last_visit_date datetime(last_visit_date / 1000000, 'unixepoch') url title from moz_places order by last_visit_date desc limit 5;"), "SELECT url FROM urls WHERE url LIKE '%^" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select url from urls where url like '%^"), "SELECT url FROM moz_places WHERE url LIKE '%^" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select url from moz_places where url like '%^"), "SELECT name From moz_cookies WHERE host LIKE "%8" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select name from moz_cookies where host like "%8") "SELECT name FROM cookies WHERE host_key LIKE '%@" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select name from cookies where host_key like '%@") "Select * from Win32_ComputerSystem" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: "select * from win32_computersystem")2a:T1a91,Found reference to API (Indicator: "FindWindowEx"; File: "DownloadHelperTray") Found reference to API (Indicator: "ShowWindow"; File: "DownloadHelperTray") Found reference to API (Indicator: "SetForegroundWindow"; File: "DownloadHelperTray") Found reference to API (Indicator: "SetWindowPos"; File: "DownloadHelperTray") Found reference to API (Indicator: "SetParent"; File: "DownloadHelperTray") Found reference to API (Indicator: "EnumThreadWindows"; File: "DownloadHelperTray") Found reference to API (Indicator: "GetWindowText"; File: "DownloadHelperTray") Found reference to API (Indicator: "GetWindowTextLength"; File: "DownloadHelperTray") Found reference to API (Indicator: "SendMessage"; File: "DownloadHelperTray") Found reference to API (Indicator: "SetWindowLong"; File: "DownloadHelperTray") Found reference to API (Indicator: "GetWindowLong"; File: "DownloadHelperTray") Found reference to API (Indicator: "CreateDirectory"; File: "DownloadHelperTray") Found reference to API (Indicator: "Sleep"; File: "DownloadHelperTray") Found reference to API (Indicator: "MessageBox"; File: "DownloadHelperTray") Found reference to API (Indicator: "RegisterWindowMessage"; File: "DownloadHelperTray") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "DownloadHelperTray") Found reference to API (Indicator: "GetWindowTextA"; File: "DownloadHelperTray") Found reference to API (Indicator: "EnumChildWindows"; File: "DownloadHelperTray") Found reference to API (Indicator: "LoadLibrary"; File: "DownloadHelperTray") Found reference to API (Indicator: "GetProcAddress"; File: "DownloadHelperTray") Found reference to API (Indicator: "FindWindowEx"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessage"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp")2b:T2129,"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Langu" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp 00000000-00002096.00000001.71472.000C8000.00000004.mdmp 00000000-00002096.00000002.73391.000C8000.00000004.mdmp "1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp 00000000-00002096.00000001.71472.000C8000.00000004.mdmp 00000000-00002096.00000002.73391.000C8000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microv" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp 00000000-00002096.00000001.71472.000C8000.00000004.mdmp 00000000-00002096.00000002.73391.000C8000.00000004.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Windows NT\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp 00000000-00002096.00000001.71472.000C8000.00000004.mdmp 00000000-00002096.00000002.73391.000C8000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002096.00000000.69552.024E0000.00000004.mdmp 00000000-00002096.00000001.71472.024E0000.00000004.mdmp 00000000-00002096.00000002.73391.024E0000.00000004.mdmp "E\SOFTWARE\Microsoft\Windows NT\ttrr" in Source: 00000000-00002096.00000000.69552.043D8000.00000004.mdmp 00000000-00002096.00000001.71472.043D8000.00000004.mdmp 00000000-00002096.00000002.73391.043D8000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Classes\Applications\firefox.exe\shell\open\commandH" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "HKEY_CLASSES_ROOT\ChromeHTML\shell\open\command>" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.Servic" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp 00000000-00002096.00000001.71472.04590000.00000004.mdmp 00000000-00002096.00000002.73391.04590000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp 00000000-00002096.00000001.71472.06EE0000.00000004.mdmp 00000000-00002096.00000002.73391.06EE0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp 00000000-00002096.00000001.71472.06EE0000.00000004.mdmp 00000000-00002096.00000002.73391.06EE0000.00000004.mdmp2c:T59d,Observed unmanaged function "FindWindowEx" in "DownloadHelperTray" Observed unmanaged function "SetLayeredWindowAttributes" in "DownloadHelperTray" Observed unmanaged function "ShowWindow" in "DownloadHelperTray" Observed unmanaged function "SetForegroundWindow" in "DownloadHelperTray" Observed unmanaged function "SetWindowPos" in "DownloadHelperTray" Observed unmanaged function "SetParent" in "DownloadHelperTray" Observed unmanaged function "EnumThreadWindows" in "DownloadHelperTray" Observed unmanaged function "GetWindowText" in "DownloadHelperTray" Observed unmanaged function "GetWindowTextLength" in "DownloadHelperTray" Observed unmanaged function "SendMessage" in "DownloadHelperTray" Observed unmanaged function "SetWindowLong" in "DownloadHelperTray" Observed unmanaged function "GetWindowLong" in "DownloadHelperTray" Observed unmanaged function "RegisterWindowMessageA" in "DownloadHelperTray" Observed unmanaged function "DeregisterShellHookWindow" in "DownloadHelperTray" Observed unmanaged function "RegisterShellHookWindow" in "DownloadHelperTray" Observed unmanaged function "GetWindowTextA" in "DownloadHelperTray" Observed unmanaged function "GetWindowTextLengthA" in "DownloadHelperTray" Observed unmanaged function "EnumChildWindows" in "DownloadHelperTray" Observed unmanaged function "LoadLibrary" in "DownloadHelperTray" Observed unmanaged function "GetProcAddress" in "DownloadHelperTray"2d:T48f,"DownloadHelperTray" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2e:T48f,"DownloadHelperTray" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2f:T48f,"DownloadHelperTray" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"30:T4c1,"DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "DownloadHelperTray.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP")31:T4d5,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002096-00000C28-1271573220] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: DownloadHelperTray.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: DownloadHelperTray.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: DownloadHelperTray.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: DownloadHelperTray.exe.log]32:T5b4,"DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")33:Tacf,"DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DOWNLOADHELPERTRAY.EXE"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "DownloadHelperTray.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")34:Tb10,"DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTSP.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWRITE.DLL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL"35:T88a,"DownloadHelperTray.exe" trying to access non-existent file "C:\Windows\apppatch\sysmain.sdb" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\DOWNLOADHELPERTRAY.EXE.CONFIG" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOWNLOADHELPERTRAY.EXE.LOG" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\DOWNLOADHELPERTRAY" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\DOWNLOADHELPERTRAY.INI" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\DOWNLOADHELPERTRAY.EXE.LOCAL" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\ACCESSIBILITY" "DownloadHelperTray.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\ACCESSIBILITY.INI"36:T1696,Pattern match: "http://ocsp2.globalsign.com/rootr306" Pattern match: "http://crl.globalsign.com/root-r3.crl0b" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0" Pattern match: "ocsp2.globalsign.com/gsextendcodesignsha2g30U" Pattern match: "crl.globalsign.com/gsextendcodesignsha2g3.crl0" Pattern match: "http://ocsp.globalsign.com/ca/gstsacasha384g40C" Pattern match: "secure.globalsign.com/cacert/gstsacasha384g4.crt0" Pattern match: "crl.globalsign.com/ca/gstsacasha384g4.crl0" Pattern match: "http://ocsp2.globalsign.com/rootr606" Pattern match: "http://crl.globalsign.com/root-r6.crl0G" Pattern match: "http://crl.globalsign.com/root-r3.crl0G" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "ws@.ws" Pattern match: "https://www" Pattern match: "https://location.cdnawsco.com/full/o0DrSUwBOXH750CT8fGz0UnMeEXd3UU685ZI4WL7Yl0/" Pattern match: "https://location.cdnawsco.com/selfip/EfT5lo9lKLCDLJVYUqeH95L4SrkG805vMiPEC6HqzMs" Pattern match: "https://saedion.com/api" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Heuristic match: "/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0"37:T2275,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp") Found URL "https://www." - Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp") Found URL "https://location.cdnawsco.com/full/o0drsuwboxh750ct8fgz0unmeexd3uu685zi4wl7yl0/https://location.cdnawsco.com/selfip/eft5lo9lklcdljvyuqeh95l4srkg805vmipec6hqzms\\\/http(s" - Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp") Found URL "https://saedion.com/apipdftoolswebpipedata" - Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp") Found URL "https:///postback?cid=caid=-clk/postback?caid=*&attribution=cid-caidmozilla/5.0" - Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp") Found URL "https://saedion.com/apipdftoolswebpipefulltrustfulltrustinternetnothingexecutionskipverificationlocalintraneteverythingmscorlib.resourcessystemsystem.resourcessystem.xmlsystem.xml.resourcessystem.windows.formssystem.windows.forms.resourcessystem.datasystem.data.resourcessystem.securitysystem.security.resourcessystem.drawingsystem.drawing.resourcessystem.messagingsystem.messaging.resourcessystem.serviceprocesssystem.serviceprocess.resourcessystem.directoryservicessystem.directoryservices.resourcessystem.deploymentsystem.deployment.resources" (Indicator: "GetDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp")3b:T5ce,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp")3c:Tfcc,"DownloadHelperTray.exe" wrote bytes "f04c1775c056177530081775c0611675606e177500551775504f1775f0431775501a177550b51975c01b1775f031177550671775" to virtual address "0x7424E164" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "c0022e7460062e74" to virtual address "0x758D004C" (part of module "COMBASE.DLL") "DownloadHelperTray.exe" wrote bytes "907c1775002b17750039177570a21775b0af1775708c147550741475d0d0197560af177580801775b0841775f05f177530a31775" to virtual address "0x7424E060" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "40d22d74300d2e74e0f62d74c0cd2d74" to virtual address "0x748E16C4" (part of module "WINDOWS.STORAGE.DLL") "DownloadHelperTray.exe" wrote bytes "1032047780ec0877208a057700000000" to virtual address "0x740B3000" (part of module "WIN32U.DLL") "DownloadHelperTray.exe" wrote bytes "1075526e" to virtual address "0x738CE000" (part of module "GDIPLUS.DLL") "DownloadHelperTray.exe" wrote bytes "30ae1874" to virtual address "0x755A1094" (part of module "RPCRT4.DLL") "DownloadHelperTray.exe" wrote bytes "408a6575" to virtual address "0x72E101B0" (part of module "COMCTL32.DLL") "DownloadHelperTray.exe" wrote bytes "97cee9e5" to virtual address "0x718DF798" (part of module "CLR.DLL") "DownloadHelperTray.exe" wrote bytes "801f1675a05a1775e0941775d07b1775b01e1675d01d1675f0e31975703f177550fa1475a0801575" to virtual address "0x7424E138" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "708c2275503c2275c02d2275908f2275c0202275b09522753025227570472275402d2275f0bb227530492275a026227540942275308e2275c080227550b82275d0272275c0ce2275f0262275d0942275a0842275" to virtual address "0x72E10100" (part of module "COMCTL32.DLL") "DownloadHelperTray.exe" wrote bytes "705b2374906a237440372374f06b237470682374d06a2374e0452374e03a2374e0682374b0692374b06b2374b0552374506a2374b0712374406b237430692374806d2374707a237490372374" to virtual address "0x7523D000" (part of module "IMM32.DLL") "DownloadHelperTray.exe" wrote bytes "a0926103b0926103b017010080f00600c0020100b0f0060060b20600e0916103f0916103" to virtual address "0x73B0AC94" (part of module "USER32.DLL") "DownloadHelperTray.exe" wrote bytes "e03a1775e0021775f03d1775" to virtual address "0x7424E000" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "10f2aa7300b9a973f0910a77109daa739092aa73c0b4aa735088aa73d067aa7340b2aa73209caa73108caa73a0a4aa73507caa7350a9aa73c0b3aa73805daa73c0e6aa739075aa73c0eeaa73a0c4aa7300c0aa7310d2a97360aaaa73" to virtual address "0x758D0228" (part of module "COMBASE.DLL") "DownloadHelperTray.exe" wrote bytes "50651a7510ed16758072177570c61975" to virtual address "0x7424E04C" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "d04c757270647572f0407572003f7572205d7572606b7572f0287672c03c7572" to virtual address "0x73542078" (part of module "UXTHEME.DLL") "DownloadHelperTray.exe" wrote bytes "1036a6732036a673" to virtual address "0x758D01A0" (part of module "COMBASE.DLL") "DownloadHelperTray.exe" wrote bytes "70ebaa7300ecaa7340ecaa73" to virtual address "0x758D01FC" (part of module "COMBASE.DLL") "DownloadHelperTray.exe" wrote bytes "e02aa373f029a373702aa373" to virtual address "0x70BF700C" (part of module "RSAENH.DLL") "DownloadHelperTray.exe" wrote bytes "00891775" to virtual address "0x7424E010" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "b07f6675d07f6675b0596a75" to virtual address "0x748E1778" (part of module "WINDOWS.STORAGE.DLL") "DownloadHelperTray.exe" wrote bytes "10761775a05f177530d51475f0561475a0e71975e07b1475b0d61975b024157510451775204d177590e51975" to virtual address "0x7424E19C" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "309f1775f0661a75702a167520a4177570231675003b177510601775b05b177500b01775805b1775d0811775d00d1575" to virtual address "0x7424E018" (part of module "GDI32.DLL") "DownloadHelperTray.exe" wrote bytes "d0e41775c0e41775a0dc177520b1177590af1775f0561775e0861b7520c7177540ec177520ee1775" to virtual address "0x7424E958" (part of module "GDI32.DLL")3d:T109c4,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy9fahlV53nvbkUEkIIIiFICCEURUYkOOKEjIRMZo84GSdTk66OZYxJ5f3F6qSSVGIlajpqxVReKpUYM2o7jgwZkUaCNBJEHAkyijQ9jSMyNGFo+pEgD5JHmqaRoZEQivtY99Td5/f9rL1/++x7Tu177r3fD98/9llr7bXXfqms9bmNq6sqZWVFUlV/I6krSfURzRDO0ezSkK9rlA9qct6pqX6ryXlDk/OS5rAmZUUzhHPOkcwFh7EvZlXhueQZCXt+WHNC83vNEGrNbg2vu1dyZSW5XPNeTf5t4Gv/5CezHDok+dznJM8/L3npJclnPys5cEDy0Y9Krr5a8q/+leTKKyX/5t9I3v9+yT//55JLLpG8732Sf/bPJLguLvShD0lQe9VVEtwgev6X/1KC2//whyW4/X37JHfcIbn5ZsmNN0ruukuC1/3gg5JHHpF8+tOST31Kglrk4YclDz0keeABCUZ1222Sm26S3H675OBBCXo+ckTy+c9LvvAFydGjWdA47wq1X/xizE+GwH/OKUeV1f9ZLWO+970zFDyN9/z3/2/D+X/MtgafijFmubAQpqSLfmIhjFgILYQWQguhhXA5UojcooKnUWre7KFAmO0FPhVjzHJhIUxJF/3EQhixEFoILYQWQgvhcqQQuUUFT6PUvNlDgTDbC3wqxpjlwkKYki76iYUwYiG0EFoILYQWwuVIIXKLCp5GqXmzhwJhthf4VIwxy4WFMCVd9BMLYcRCaCG0EFoILYTLkULkFhU8jVLzZg8Fwmwv8KkYY8amZx0PMcOaeBgnJVgTV/+oGYSYCSvP0gyCgwTf1cDxYBfgNs13JLguvWWBZI8Oq1yyouFz/nbMK69UMcOoNQDXxRerFF/7y5L03Kr6K0mdjqr6gUbBozt2TPLUUxLUwhDuvVeSL75RCyVActlAz6j9zGck6AofFgTp7rsl998vQc+HD0sefVSC6z72mAS2jECfoOVwHoz5E5+Q3HKLBF3hBnNfUo1hoEC4oz/9UwkaP/GEBB8hatEzxozHjieJDxjf5J/8ieSeeyQQ0Y9/XIIPCQ8Ww9BPhYtTY8y4cJY0xoxMsURWLIQWQgvhaSyEFkILoYXQGLN4OEsaY0amWCIrFkILoYXwNBZCC6GF0EJojFk8nCWNMSNTLJEVC6GF0EJ4GguhhdBCaCE0xiwezpLGmJEplsiKhdBCaCE8jYXQQmghtBAaYxYPZ0ljzHJxiaYHtYsem5LG2MOvqq6X1PniO6WWFEogwyhq5wG6OIhUJ5TXXpPMxxHNXo1QXBeNn9S8ojkuObeSqC/9+Z9Liu/qdxr9cqq/0Lypwf2C/RJedw5wvxAVOA8W36jFKh/JV/nPPCOBXWBUWPRDROE8gzQVFnf0qCQXUazysTcm7OLOOyWQOugErBVBVzDAG26QoDGCMePR5XeEBws9xg3iFiBXGDNMDMPA60ZXt94qQVe4QfwZAq8b3wZuEMqH5G6pXXFxaowZF86Sm8fQnYRB3It4lq669i7uKt+irKYxWwEL4caxEFoIO7AQWgibYMx4dPkdWQiTWAiN2TpwliyYCFIDqwN5bUNXh72n5w023FXZuCzZuiTr6aSqAYvz3vV5b4OEQReqZrhWb4MtgoVw41gILYQdWAgthE0wZjy6/I4shEkshMZsHThLFsCOEllKqiJdHfaenjeItXnLqq9xWbJ1mayn4/9VcJKmKmfognxo+wjOnaerCfP3sBxEG7yElQUWwoiF0ELYgYXQQtgEY8ajy+/IQpjEQmjM1oGzZAHsaPKzLIy0lsfC5jj+RJuGrpIICuPP8sRYEmlOmbSJP7cuZ0gIJ+VYtDc/Y0nZLFYlJfFn0wMK4wEaND+bki3LJRbCDWMhtBB2YCG0EDbBmPHo8juyECaxEBqzdeAsWdBqSjMWNiU4Pt1Cf3Y1LhuUoKrr9NaucO6E1sKtyGQ9vVqkqcrpWpBjrd4co31sVlbFn2VJPLHruCxEeVO45Mg6fnI/DX1CeFgjvPiipG+HUvjD9yX1HELI3T5PaMATkp7bB/fGXHddFVNwUDMH79YoJ09KeuBOoQPgl6Pkw8hri57xQuUDrqoPSer0zwEqZqytfh3zox9VMVX1hkbd8uxKUn1Lo0BykEGLYBgCVtvoGfs9Yi2OrrA3JlbbEAY4D9bi2IUSipsrAe7owQcluEG4NGwZt4+e8WAhOdAnSA7GjOtie89juossHB56DGl/8klJ3hjX/dznJLgudjfFS8FzxrcBS8dzxkt5/HEJnhUGiQeLt59v3wofvvnmGC5OjTHjwmmxYOJRDbG86yD/ebqjdVobNIVJeWTGU1rLW7ttLdyKTBaFq0Waqhwsz9ZWaKfL0Swvx0+UN4WRWB5atXTS22D5sRBGLIQWwvVaC6GFsImF0EJojDljcFos6HWq8qD5CVqbNXQ16CqPJKcANMBxQ2vhVmSyKFwt0lTlrC3JWkB587OrHD9bu20trIryspPeBsuPhTBiIbQQrtdaCC2ETSyEFkJjzBmD02IB1KhUqVbLKn829JZ39dN1YlVU9Z4Sy1vbtBZuRSaLwtUiTVXO2pKsBZQ3P7vKUVKWdxVWRXl5rd4Gy4+FMGIhtBCu11oILYRNLIQWQmPMGYPTYkGXa02OE7PqqkWzhtig63hy0EqsbT0d5WVhUrJ14aIwkFQ1rC3JWkB587OrPJaUhROS8th/ea2ui3Z1uIRYCCMWQgvheq2F0ELYxEJoITTGnDE4LRZMnKqhrI3HaNOUoLA5jsxyIkoiaBmPyxNbG7TWbnVW0/SC5dnaCu10OZo1B0mzpLDqLq90GLEQB2U5TllaZPvHD3ygiqlWNOCcbN/FV1+VDNyD9CnNoHNTeO5nNKoTYJgv6ZirtyUcRs7jGu2Ko1KnzXmf5nIN2CPBpozFXwf+SVKnSl+jFo9uCBdo9Aabf5br/zhxofyPBWeMAwckkA3YFBbBCMQMooJtJ1GL3HefBAaIxTfsEWtxNEZX+SDRM24Qq/zbb5fAS+++W4KuMCo0RlcI7hfn4vbxYPPnjJ7RGP8IcV08HDitGlF1220SfHXoChfCG4Raw//hlvmfA/K/SuAN4stB0sZcnBpjxoXT4kCWx50gdRtmUf2YLraEoY2MhdBCaCGcxEIYkosKluYWQgthEwuhMWYgnBaHYHEyQ7ENtmIhtBBaCCexEIbkooKluYXQQtjEQmiMGQinxdnw/xnNDGV9+WdasBBaCC2Ek1gIQ3JRwdLcQmghbGIhNMYMhNOiMWZ0LIQWQgvhJBbCkFxUsDS3EFoIm1gIjTED4bRojNkhcGmuslGdp7kk3e3zXZoh/Pa3kmK7y5c1GW+/LekhHTMfjvLrX0sKq/lIzFtvVTHg/PMl2MATw8DarPqAJldcvN8cvP28dlUDL91dSerMPHG/qH3ttSqm2N10CNiDNDexcmkbg4U7usJ+j9jC8bHHJNhYEo2xOSQaY4/Kp56SPPus5LnnJMePS7DrJi6UBxtpYhjPPCOZZ4tOBLePW8AwcPsvvCBBbf6snn5aghtE8sa4Bdw+Hg42/0RXuF88K3SFUaExhoHGCB47ajFIfftcnBpjxoWzpDFmh8DF9x4L4RQ+HMVCaCG0ELYHOoFhpEpAUbEQWgiNMWPBWbJg8j8XnPwvBn28ucfGLBIuvvdYCKfw4SgWQguhhbA90AkMI1UCioqF0EJojBkLzpLGmB0CF997LIRT+HAUC6GF0ELYHugEhpEqAUXFQmghNMaMBWdJY8wOgYvvPRbCKXw4ioXQQmghbA90AsNIlYCiYiG0EBpjxoKzpDFmdGTVizoskf/pn6qY6iJNrgQ9YBjZqIatxd+ryXm/5He/kxTXPaz5sUbEjBeq/iLmjTeqGPSMtzDwOcumo4XVCBdcIKmq30nOSjdZxag0vIVB7JEUXam0a+O+YRyR1NDFefi9pvmST4XDePzxLFh8Y+GO2kGChDz/vORLX5KcOCHBuelqm4PEwh2GgFuAEuC6ECSYJxrj0SEYBm4ByVUkD54GXneuQBhG/nAg/EeOSPK9Xg8fHhDsFPrII1nwlwXcEf4MgZ6R/AbxIeET1S+Hi1NjzLhwClUwaQK2NssI/niPbAL+ckpkqYo6/KuzEFoILYSzYSEMwSAhSDAxC6GF0EJozA6DU6iCSROwdRszto/NmpathWYgjfu1ZiYW+woW1c92QpaqqJv+C1jDQmghtBDOhoUwBIOEIMHELIQWQguhMTsMTqEKJk3A1m00zfL2rbWthWYgq2n6iW9hIW9kIZ1sM2SpirrwL+4UFkILoYVwNiyEIRgkBAkmZiG0EFoIjdlhcApVMGkCti5Am8nPWQontBaagaym6aF8Ba3vq/m5/mmcArVNIarQPtaWP7crslRFXXxGqxZCXvewhXAKRqXhLQxCHa/o6mUL4TQWQgthk9yXLIQWQmOWBk6hCiZNwNYFaNP8TA4irYVmIKtpeihfwaSk9c3Gr6LruGkcD+LP1sJtz2saWbnCAf7+7yWTh9uAWuwGica80K5KkoKtQQEvpMOoqkclu2UXSvT85puSBfKzn0k4ZnCpBCuoqnpDondUVd/VpKoJ6iGCBAnsQYbBSqLaVp3Q6IdEaQfSmLdfD7nfKzU9YMyoVNfCyhXBoh9fQ14Lf0BwIZwL9RpkRLjBfOfM/Bbuv18CM8FOuNhkFSYGM0HtIJdG4JZIrjHQp099SpLfL4Jnhd1rIYR33y3B7rV5Lbp68EEJhvHQQxK8IwwS5yKlmsagZ4xKw8WpMWZcOC0qmKwBWxegTfOz9SCSFJqBrKbpoXzs8e10HcxYDsr2XS23HxZCC2HHdeshgmQhzLAQWgjXYyG0EBpjFE6LCiZrwNYFaBN/oofW3loLzUBW0/RQvoKmpPUAoEH5M2+PE7cxFkILYcd16yGCZCHMsBBaCNdjIbQQGmMUTosKJmvA1gVo0/xMDiKthWYgq2l6KF9B+crKA9D7GZQ/J8ddHW4/LIQWwo7r1kMEyUKYYSG0EK7HQmghNMYonBYVTNaArdtomsX2ZWFrb62FZiCrafppfXHNT9S2Ni7PKsvLc3HW9sZCaCHsuG49RJAshBkWQgvheiyEFkJjjMJpUcFkDdi6jbI9Tpz8bO2ttdAMZDXNTOANorwsQXnZJh43jZNmO5yNr8Wb59s85bRnYf9+yTDZ0MY9w3i3ZnHguidPVjF/93cSUmsG3VH1pAbP+R81H4m59toqpuBezfc1f6mRntFR3y0MYSVLcaFvaU5qcvC164M9t5JgA14KsJ6LRTDWtdj+EY0R+MOjj0qwhSNEBUb06U9L0DMCFTl0SIJaLMfLu4jB7RdL+Sy5a2HLSjwciCgCl8bTgIrceafk+uslH/mIZO9eyb/9t5Krr86C/27ecovk9tslGNXNN0tuvVWCruCHeN24fTzn/LuCpeMDRldoDNPGhdBYPwYuTo0x48L51pjlYN416jYCOmEhnBVc10IY6buFIRQSaCGcxkJoIbQQWgiNWXo43xqzBMy7QN1eQCcshLOC61oII323MIRCAi2E01gILYQWQguhMUsP51tjNpX1RaOZAp2wEM4KrmshjPTdwhAKCbQQTmMhtBBaCC2Exiw9nG+NMUsGdMJCOCu4roUw0ncLQygk0EI4jYXQQmghtBAas/RwvjXGjAxWzKBYBGNdO4RLNbsGbCtaDOMajaL6VJy7VwNwg7pwv7yS5FwogRDOwxVXSIob1DH3oOeel28Mi55x3TcltTptTiFykhpdTV5NkxR4GtALvf22pODtmJdeqmIGSruChSz2t0Q+//ksjz8uQc+oxbm4EHQxt8dcvWAI0AnsUYlACLHP5Cc/KbnrLkmuQGh8xx0SDANmggcLmYR74LHj4SC4EPbkROP8/WLvU2wM+8QTErxfGC9ed377eePc4vKu8i8WuohvEh+hvl8uTo0x48Jp0RgzMli5gmLRP2QtDiYe2GSXhXCDWAgHfIQWwhjU5svrUgJjsFK3EFoIuywOjS2ExpgCTovGmJHByhUUi/4ha3Ew8cAmuyyEG8RCOOAjtBDGoDZfXpcSGIOVuoXQQthlcWhsITTGFHBaNMaMDFauoFj0D1mLg4kHNtllIdwgFsIBH6GFMAa1+fK6lMAYrNQthBbCLotDYwuhMaaA06IxZmSwcgXFon/IWhxMPLDJLgvhBrEQDvgILYQxqM2X16UExmClbiG0EHZZHBpbCI0xBZwWjTFjg8U3V9sPa9TEBglSrblEk3OVBugt7N4t6QH2qF0NW9ZXhzQDvKXQRRjvjzUpZ2tqzS6N3m/1Dk1ei65yaknPg8V1CR6sauqVlWS3Zhh4ocLll0v4BnX3WjSuqhsl+aIfC1k0xgae8CUEG3jCiLDfI8wkNyL4A5b1aIztH7GOx06h2MESd5TvX4rgQtAniApUBHeEnWARDBKqCS/FBp7IgQOSG2+UoPaeeyT4kHALSP7nANTi0ZW7sMbk5omu8JmhNvdDfIQQ4FSPuTg1xowLZlhjzOhw8W0hnKbHW4iFsJta0vNgcV1iIbQQrsdCaCG0EBqz9cEMu3CyJYfS1bKr3JjtAhffFsJp4r//Gf4TYCHsppb0PFhcl1gILYTrsRBaCC2Exmx9MMMunGal0bLkULpadpUbs13g4ttCOE2Ulhn+E2Ah7KaW9DxYXJdYCC2E67EQWggthMZsfTDDLhYsMyY/Zy9Myo3ZRnDxbSGcZqosa/BcYiHsppb0PFhcl1gILYTrsRBaCC2Exmx9MMMuFiwzmp/JwYzlxuxQsA0jMl3gr8GTz0ujYvaLX0i4rIeKoKtaw80wwU9jem5BB9nTuPq2JgNr/p5byF36Yo0+OoyZGqPkta++KuEgq29KatzRAvkrDZhIYxMlfZJ4VoCt6/QGV6C4OqpjxyRYE0NUEEgOVvlYQGN5jRXz8eOS556TPPusBOdilY/FN24QwoB1PK6LUSEY1TPPSNAzbh/PCtaKt4DG+S3kzwpPI79urpr4Dwf21SyVOAbbqB48KIHEQjVh6fmfMPCJ5h8w/liQ9zzojvC3A70uF6fGmHHhpLlQMGU3P5ODGcuN2aGUEmgh7GxsIbQQNqxYCC2EFkILoTGmHU6aCwVTdvyJCb2rZVe5MTuUUgIthJ2NLYQWwoYVC6GF0EJoITTGtMNJc6Fgym5+JgczlhuzQykl0ELY2dhCaCFsWLEQWggthBZCY0w7nDQXTTNrx+l79sKk3JidSCmBFsLOxhZCC2HDioXQQmghtBAaY9rhpLloyukb83gsR8u83JhtykWad2h62BvzjW9UMVV1lwb+oNQaLNxRm3eVo7tBgvjvf/h/AnTRTzDmExrUyoMtRpVfKKPo6lua/RLu9XpEg51Rc/QG31tJdFdVLOSKYeDRpeBvBzqM4mnoIFPefFPCC+mfEuiHWCLDPbAmLlf2MffeK8nXxPAHBEtzLNzhLdihFBqDlTpkA2POt1HFINEYXUFjbr9d8olPSNAYPefegjeIhwONQc+58mFL0o99TPLRj0quu06C+8XHcPfdEtRiB1rsfXrrrRKMGTeIDzhXPjw6vG4oPR47Nh3Nox7OxakxZlw4pxpjNhkLYaAwhEEcTj0NY7YQWggthBZCC6GF0JidCOdUY8wmYyEMFIYwiMOpp2HMFkILoYXQQmghtBAasxPhnGqM2WQshIHCEAZxOPU0jNlCaCG0EFoILYQWQmN2IpxTjTGbjIUwUBjCIA6nnoYxWwgthBZCC6GF0EJozE6Ec6oxZnTgAI1XTKLUMLGHNQoWwZA65a/+SjIQvYVdugfpFRrcIAS4xg0quzWDuEAzT1d1lsJqlPVm7SEwIjXAd1aSHvSxA7wyBFymqXELv5LkXal5Fl2B30n0Twm6vPxD4/+tSW8f61r0hUAXv/AFCbYVxblYbUNFYEQ33yy56SYJam+8UZLLFZTg6FHJMd2EE7X5LUCP0RiPDj1jp1AMA08SzxlvAT1DJnEunAdqjeviQk88kQXfFR47TBuBLsK0YYBofOCABDL58Y9LoLgQ4HJgMZ/8pAS1+AjxbWhjLk6NMePCadEYMzoWQgvhesg+C2HAQmghXI+F0EJojFkcnBaNMaNjIbQQrofssxAGLIQWwvVYCC2ExpjFwWnRGDM6FkIL4XrIPgthwEJoIVyPhdBCaIxZHJwWjTGjYyG0EK6H7LMQBiyEFsL1WAgthMaYxcFp0RgzOvtiCp34P5Lz0r0Tq29rsAiWC3EUw/ieBhcC81xXzj3//CqmWpUUj+6NmKJWUbvgHe0Weyy6elmijReKjgrUkmKQ92ru0gA0zrlao+CL5ceADKHO7XEI8Bas45FcCFELFYGYYfdL7AWKRT/W06jF4ht7VMIQUIv9LXEhjBn7TD75ZBY8HJyLC8F5cEeQDTw6vCMoH1QTgcVhzLA4XBc+DLfEDebv6I//WHL99RK8wfvukxw6JIHT4uHkXzteN14K3gLuF+di/1KMSp8GF6fGmHHhtEh0vcWcKdZWLy10lRuzpZE1cbGOtxBOYyHMnnNtIdwo+RIZsRBaCC2EFkJjthecFomut5jBrC1LOmlqu5p1lSesr4VaCvOqWIIDYxaLrImbT3D9Q7QQTmMhzJ5zbSHcKPkSGbEQWggthBZCY7YXnBaJrreYM8Xa6qWFrvKE9bWQlHT9bD0uD4xZLLImnnyyDRbCGAth9pxrC+FGyZfIiIXQQmghtBAas73gtEh0vcVkrK1A+DMWhoWKtIlVXQ3QpikETVVXJ5He8q4GxsyJrInjl732zVkIp7EQZs+5thBulHyJjFgILYQWQguhMdsLTotE11tMxtoKhD+bwlhbFq4vYFqOWwubY1CeiONIb3lXA2MWC5bIhxMHmHz9DX216PmERnjlFUkuGydPVjHcOHRXvs+kcPnlkh4TUx8+6yxJVf1WI7z9tqSq9mq+psk5IKn5uCR4C1D6nmf1U83LkkuyXWR76LmuskfD7wpPMmfyVTfJmedCv9coWPVCzLDqhSEgMAQEuzLCEBAoH1Qk10Us3OEPUBHcAvbVhD49+6wkVz50BT3Gg8Wzwi3k1oqgKygQhoHG+BhuvVWCPTmR22+XoCvcArYGxbl58Ini9svPMgbvCH/CyF8ZusKDxbm4ECz985+P4eLUGDMunBbJapoeTi3Y+g4iXbVleVcDkLRviIWhyZSuTow5Q2DVm62Y46dcfqBFLXq2EFoI1+m5rrLHQtgd2AViIbQQWggthMYsH5wWyWqaHk4t2DoOJsenF3WhBAdd5c25DdPW66CwtU3V1jnobWDMYsGqN1sxx38D5Qda1KJnC6GFcJ2e6yp7LITdgV0gFkILoYXQQmjM8sFpkaym6eHUgq3jIFLWollZ3toPaBaNDWyxRlO+4QbGLBaserMVs37h/ECLWvRsIbQQrtNzXWWPhbA7sAvEQmghtBBaCI1ZPjgtktU0/ZxetoWfOGgtjGfhuCyM5REUlp2UP1uPywNjzihY9WYr5sm/hIa+WvRsIbQQrtNzXWWPhbA7sAvEQmghtBBaCI1ZPjgtktU0/ZxetoWfqGqtbaq6GqBNUxhrWdTRvzbpGVVTaMzi4DaMv9KkXKXhilmV7w+OFEOekNSZAQLIFWr1KoWJ9YxKgT6BOUSlGPN3JGdXMd/+tqSH3LXy2uqIpIZbzsNvNMpKGoWPDi8U58JaVyV33CEp9i99WJODt69gVLo25UL2mWck2JQSWyliAY19F2+7TYJVPvwBW0fiQlh8Q8xwR0ePSnCDEDPYI3yptK9ERSAMqIXTwofvvFOCbTb/6I8kH/+4BA8WHo7njHeE+0WwVSZeSv4xQOkxDDgeavFSEPSMxz5I+RBYHD4k/FtA7VNPZdFzuTg1xowLZ0ljzNhYCLNRKRbCmLmwEIZYCC2EFsLWWAiN2RlwljTGjI2FMBuVYiGMmQsLYYiF0EJoIWyNhdCYnQFnSWPM2FgIs1EpFsKYubAQhlgILYQWwtZYCI3ZGXCWNMaMjYUwG5ViIYyZCwthiIXQQmghbI2F0JidAWdJY8xy8Q4NjIgr9XSVX2tycF0FDgDYurpXo6hr9aD+8OabEiy2P/QhCQyhZ8w1npXaxW7d/hSNF5j3aQD+lKDfBrd+rb4l2aUiiu8KqU5qVFMHvcGexkPeEW4/v6PqGzEvvljFcNX72c9KUIv1NGrhWugK6oWFO+QKvoRdN9EYtdCJvCsEjSEb8BZslQlRgT7hfvGsILGQjWPHssCH8dhxR9hkFUKIc3EhjOr4cQmGAUF68kkJPA0fEp4VbgHBY8dfVuDD+ENDHgwDd4SngaAxtqvVxlycGmPGhTOsMWa5sBBGLIQRC6GF0EI4iYXQQmiMmQPOsMaY5cJCGLEQRiyEFkIL4SQWQguhMWYOOMMaY5YLC2HEQhixEFoILYSTWAgthMaYOeAMa4xZLiyEEQthxEJoIbQQTmIhtBAaY+aAM6wxZmy4chWuvlpCdmvgLYys4196qYqpqjc0Q5bmPaiKDFHNapeu8snLMYUCATyNbMtKDOPll6uYqjqsuUZyeSUZRH6/+FQu1CwSPCvhBz+QFI0leJIAPecU71fePnc3xbPCg4VpY1mPbUWxjse6FhqTKwE2WsSFnn5aglEdUzOBTuTahj+WIBCkXOoQ2BQCFUHQGPt5ovGtt2a57joJNh298UbJnbp/KZ4VbhA7o0Ji4Uu4BWx2+rGPSTCqgwclUD48K/xVAh8havNbQGN8V6jNG+Pjx6jSR8fFqTFmXDjjgtU0m0fXQqKr3JglxkIY4IVyQbIQWggthBZCC6GF0BgzH5xxwWqaPoZO91XfKU1tV7Ou8oTWZUmzXEmqYgkOjBmChTDAC+WCZCG0EFoILYQWQguhMWY+OOOC1TSbR9dCoqs8oVyWJD9bj8sDY4ZgIQzwQrkgWQgthBZCC6GF0EJojJkPzrhgNU0fzXQ/OcAaAIuBpk0sie1jbVPV1QBtmkLQVHV1Eukt72pgTIqFMMAL5YJkIbQQWggthBZCC6ExZj4444LVNH000z2m/skxFgMoLNvjoOu4tbA5BuWJOI70lnc1MGbj1LWkqv6v5meaQ5L3VhIq3/djzjmniqkuk2BJXBgR5GqvBEvzd2qqb2tgFBjzIDDIFMjVuzQXaKprJZdWkkGcqyFr77FJrXuQAjznnDrtSnnrLUlV/VBSF73FKJP/HDewugf5Noqufq1J3/67Nfk2mxAkbOBZykkSGALEDDt2YlQQlXwtDnuEauLfMxbukFhcCOcisGXUYiPNfINWuEfeGLUYc+5LkLpHHpF85jNZsCUpRoXr4uHglT2hW3RikOgZY8Yrw9vH3x0wDCS/EG4ft4Bz8XDgtPpnCC5OjTHjwlkSrKbpo5nuMe+X5clBpKu2LO9qAJL2DbEwNJnS1YkxC6CuLYQxg8AgUyyE3VgILYQWwvZYCC2ExmwLOEuC1TR9NNM95v2yvDyYHK9P9NMSHHSVN+c2TFuvg8LWNlVb56C3gTEbp64thDGDwCBTLITdWAgthBbC9lgILYTGbAs4S4LVNH000z3m/bK8PIiUtbN3mDBZRUTYYo2mfMMNjNk4dW0hjBkEBpliIezGQmghtBC2x0JoITRmW8BZEqym6aOZ7jHvx5/rUzmr8sJ4Fo7LwlgeQWHZSfmz9bg8MGZh1LWFMGYQGGSKhbAbC6GF0ELYHguhhdCYbQFnSbCapo9muse8H3+uT+WdVa21TVVXA7RpCmMtizr61yY9o2oKjVkMzQeHz64d2oW6FpznKs0uzXmaHq6XvE+3cKxOarJlfQ6uetllklxFqhWN7rnKxtiyMgWbQQ7ihRckBfdqUiiEqRHl4Fnx0aWNed29GqXWXKIh8uVgi938U0EtNyy9U7edhAHCEHLZQLDKz3cZzRfukCtcKNcnGAKGgWU9esYqH8t6PA04QG412P0Spg0tf/BBCRrjlR05IsGYsZ8ndhlVUaluuEGCvU8xyNwtMchDhyQHDkiuv16CHUpvukmCO8Kzmkdx8xeKt58rLr4rlVguTo0x44JJ0xizXGAhy2pgIYwBE11pYiFMwLPio0sb87oWQguhhdBCaCE0ZqnBpGmMWS6wkGU1sBDGgImuNLEQJuBZ8dGljXldC6GF0EJoIbQQGrPUYNI0xiwXWMiyGlgIY8BEV5pYCBPwrPjo0sa8roXQQmghtBBaCI1ZajBpGmOWCyxkWQ0shDFgoitNLIQJeFZ8dGljXtdCaCG0EFoILYTGLDWYNI0xSwYsrtYob78tqc6X/OY3EjZ+L7YkfVlSy3WxvAYyplPoOj6nzm6w2O1TB7kmBtP0sF8DjRGKG3w95p57qpjRePhhyTDU/4sb3DjsqtYXeumAHVnRFWDPChrTALEvbq5AWObCtXITw3oaCoS1OHQCweIbF8ItwB5zAzxxIstzz0mef16CZ4Uxw3kgKhAknJt7OLqCp0GubrlFAptCLUaVB16K/xbALdEYFld2ngQiimeF94u/LKBWxYy1eCnY+RbvFxvhwsMxZj2Xi1NjzLhwEjXGLBcWwoiFMGAhTD4VNLYQWggthBZCY0wXnESNMcuFhTBiIQxYCJNPBY0thBZCC6GF0BjTBSdRY8xyYSGMWAgDFsLkU0FjC6GF0EJoITTGdMFJ1BizXFgIIxbCgIUw+VTQ2EJoIbQQWgiNMV1wEjXGjM05Eixk2bh6UvLOSlIdl1xWSapvSN5fSWosrz8kubyS6Jh5LnYZRa2qSAHE7EhM8XD2DVDNnHRUxXWzWpA3rqpnJPnHgL8OkEOaQeBJfjjmPe+pYnq2YOVfFvZmu4xepOnhoOZbGuVsTXWNRsEyF7KBhSw2pbz7bgk2LIUSYAF9+LAEw8B180GiFsGYc7vAXxoQGCACxYUC4eHA4jAq7BSKnmHauVqjce7/aIzbx7PCC81fGUaFPyVgT05sOQsPf/ZZCe4ITwOBp83zrHAL+J5xIdTqs+Li1BgzLpwWlT8sQJIYYxZB7gDEQhgfzj4LYeCQhXCKhTDGQji75KCxhTB5VhZCY7YLnBaVUgKXRAhPr47aCvOqWIIDYzaJ3AGIhTA+nH0WwsAhC+EUC2GMhXB2yUFjC2HyrCyExmwXOC0qMEBkEzm9OtKSrp+tx+WBMZtE7gDEQhgfzj4LYeCQhXCKhTDGQji75KCxhTB5VhZCY7YLnBaVxv1a08vaame6pEFVWT45LstBU1WeW9Jb3tXAmLHIHYBYCOPD2WchDByyEE6xEMZYCGeXHDS2ECbPykJozHaB06KyWkhgTC+n1zDhZ1nedTz52RxHYvuyEPSWdzUwZjSwFtcF9EolWSRYXoPctXSQV1SSWqP84AeS6hINOaxRaCbSePIflAbsQfrBD0r6hqGco1GwgDyDb7DOnnNVndAo6S301A4Cfx3QnvmOqv835sILq5iqeluzV5L3rLXcdBQLdyzrISowsVzMYGJoDOfBXpFYfGP7R2xYimDxjevC02A12CsSHzT8AYPE3qf5LaAxbh/XzUeFJ4me8XCwYSl8CW8QDweSg08Fjx2DxLmlqsXgOWMYGCR6RqCa2DYWm8pCRNH4+HHJsWMSPFjIJN6+hotTY8y4cO5WVgsJjOllbX5v+Tm0HCTtG2JhaDKlqxNjxgfqpcvcM6cTFkILYcct9NQOwkJoIey6BQthEguhMWZEOHcrq4UExvSyNr+3/NxA+ek5vbsN6OqzobeBMaMB9dJl7pnTCQuhhbDjFnpqB2EhtBB23YKFMImF0BgzIpy7ldVCAmN6WZvfW34OLUchYIs1mvINNzBmNKBeusw9czphIbQQdtxCT+0gLIQWwq5bsBAmsRAaY0aEc7cyEb+u9LI2v7f8PD1Btx1PDlp/thbOcm7rcXlgzGYB9dJl7pnTCQuhhbDjFnpqB2EhtBB23YKFMImF0BgzIpy7ldVCAmN6WZvf23/KTN3WoPzZWhILW/tEVSzBgTFLAZequpCtqu9I6lwJZIvOathGmi9LaDXaM5bmPWjPCodB5csaA96vPskf/UiS98xq3XO1p3H1kiZVXN3ek7egFNf9kCZv/H814LeanPSOztPwewbf1OTsS/5mUdwv0HPhD1jXohbBroywmlxjsMpHIJPYsPSGGyS33CK55x4JhBDDwC1gzHAtDBIKBPWCEuT2iHNRm78UCMYXvyjBdeFauF8E8gzXwpjxJDFmKB+6glsePCgpBxaD6+IGMUh8ogheKAYJEcWHhE1H8/erT4OLU2PMuHCSNMZsLhZCGYaFcMArsxBOKe4X6LmD3APBWtxCGGMhtBB2vV8LoTHLBCdJY8zmYiGUYVgIB7wyC+GU4n6BnjvIPRCsxS2EMRZCC2HX+7UQGrNMcJI0xmwuFkIZhoVwwCuzEE4p7hfouYPcA8Fa3EIYYyG0EHa9XwuhMcsEJ0ljzOZiIZRhWAgHvDIL4ZTifoGeO8g9EKzFLYQxFkILYdf7tRAas0xwkjTGjE66G2TOHskHPiAp1sRwAFnHF411xazr+Ouvl5DdmnmoJRdcIKneran+h+TsSgIu1ShnnSUpHo5w9KiEpE8DC+aqekOjbwHbbOZyVed/LFCgbaAe0lX1LY18ZvjbAR9sPeRCK/gjBS40hE9+UgKbwqoXggTZgJk8+aQE30ruS/AHrMXhePA03BHsAot+9IwbhF3gurjQnXdK0BjXhT/g4eDRPf10FuyNiXOP6WaYOBcbaT77bBZcCOaJtw+bwnd14IDkttsGBJqK94uPAcPIg68d3wYuhMbQVBggviuVWC5OjTHjwmnRGDM6FsJuaomF0EI4ZcVCaCG0EFoIjTELgNOiMWZ0LITd1BILoYVwyoqF0EJoIbQQGmMWAKdFY8zoWAi7qSUWQgvhlBULoYXQQmghNMYsAE6LxpjRsRB2U0sshBbCKSsWQguhhdBCaIxZAJwWjTHLDQxBZfLKSqLCgMU36FECUEvYVQ9f04ghoCl6BsXTOKLJuVZznUbJ3ZIWNw+4IwT8peZwzGWXVTGgeJIvS9b+vjAN/pTAWoWWDn4vuaSKwRa7114rmY9HJbV+wxAzmBiMCKteBKte7DOJHR11TUxBgj5BrnBd9AxhgIpgS1JsZwoHQM+wVtwggn0mn3hCAgPMfRgPB7KBoDFeCp4knhVeN3wp12O8FJyLxrhByBWeJG4Q5+JTQWO8UPQMiYUt4x3hXwruFzd4330SPA0LoTHLhEyYW5CfrMHSgXT10JR3NWhYyDCMmQUYgoUwxkI4jYVQsRBaCC2EFkJjTDsyYbYxUZ0IWyi9DRbLoMt1Ne4t72oQmaWNMfMDQ7AQxlgIp7EQKhZCC6GF0EJojGlHJsw2hnrO0PZzspDLdXViITRLCAzBQhhjIZzGQqhYCC2EFkILoTGmHZkw2+jynEn5T9ZpCsuSpryrDQqb8tig/FmWhA5OlcfjpkE8juTlXQ2awqYKJcYsHBiChTDGQjiNhVCxEFoILYQWQmNMOzJhttElOTCi5hjty2axZX7clDTl8WdZEn+2HseDocethc1xUxJ/GrMIVOqQq6+W5HKVQ0M4v5Lk1JqVNDmQjUHnktSmas1FGnU8PhxQa8BZml0SKNAf1ESjwEt3Z/uXFt+GWiv8/10a8pRGoQGKl/L2h3FIM4SVIcGq95huSvnUUxI0huRgPY2uciNCLawmNxMowR13SLChJWqhi1jW56ICp4V64VyIChrDHvFw8GDxUiAqkJw8+R3hOWPMuS3jFuKX8Idgh1LU4mNAzxhG/rcDfDl4KXDLvGc43v33S6DW+Wem+9NycWqMGRfOoQUT7Yk05WiWl+c/e8vRYELXWV3H5cHQ8q4GrT+NWQSFBFoIZ8ZCaCGcLfnC3UJoIbQQWgiN2dZwDi3okpwuF+oqz3/2lqPBhK6zuo7Lg6HlPyk43VSbGbM4Cgm0EM6MhdBCOFvyhbuF0EJoIbQQGrOt4Rxa0CU5XS7UVZ7/7CpvjtFgQu9ZOC4PhpajAchrjdkQhQRaCGfGQmghnC35wt1CaCG0EFoIjdnWcA4t6JKcXnfq+hlb9h6XPwFa5sfxYOhxWRjLcWzM4igk0EI4MxZCC+FsyRfuFkILoYXQQmjMtoZzaMFEgSJNOZo1B0mzSQnaoDCWN7UoaYhVvccojOTlXQ2awkl5/GnMzEDzqrc16nhYx3PHTl2L12t+0oSCdETCYWhXOHd3piJszOh1L6wkc/GKRh8d4JNUajy6jK99TYIFZM5bb0kK8/xWTGGPOfLYi54H8Wi2Rad+Kj0Xyr+cizW7NPqJXnihhFygyV93vo7H0rw0iphBDoCecS6c58kns+TXRVeQK3SVnwv1gsVBJ+AAN90kueEGycc/LoHEYitU1Ql6C/4RwvFwC3h08HDoE3bsvOsuCYwIYz50SIIxHzyYBeoFx4MB4vZhvPmngm/jhRckx49L8OXkWo77tRAas0xwWtwkcptKaksx2xSWZBhma0ITsxBuGAthRB570fMgLIQWQguhhdBCaMy2hdPiJpHYVFJlzLaAJmYh3DAWwog89qLnQVgILYQWQguhhdCYbQunxU2i1fr8f3YzOwOamIVww1gII/LYi54HYSG0EFoILYQWQmO2LZwWjTFjQxOzEG4YC2FEHnvR8yAshBZCC6GF0EJozLaF06IxZmQuvlgCXntN0kemXj0r9epnmt9LdunSnPxdzAc+UMXAWvfurWIK7tX8RvN/JFdVEoKu/jLm61+vYl5/XVJV39fkPctzxpLpttskPfuIsmfkGsmKbpU5iMs13GX0kAbflZI73jD+QsIbFPPkqSlYtxOs4yEb2FkRi28Eq17YBYINHnHu7bdLrr1W8kd/JEFt3hjBv8n/+B8l+/ZJrrtOsn+/BI0RXBddYcyo/Q//IQtuAeeiFmNGLXrGLXzsY5Ibb5TcfbdkkMXBPD/1qSzlhxcDEc23BsW5+SDxTd6h+4jCltEVtFy9lItTY8y4cFo0xoyMhVCBAlkIY66xEFoI2x2vlMCkMYJ/kxZCC2HXIC2ExmxTOC0WTP6HfJP/LZ+PN/fYbE8shAoUyEIYc42F0ELY7nilBCaNEfybtBBaCLsGaSE0ZpvCadEYMzIWQgUKZCGMucZCaCFsd7xSApPGCP5NWggthF2DtBAas03htGiMGRkLoQIFshDGXGMhtBC2O14pgUljBP8mLYQWwq5BWgiN2aZwWjTGbC7Yd7CqXtbI0hyOB6pLqphij8o3YniuSk7Pjp3VfkldScA52M40oxjVxpVgod4iYKdQbKzY59J/q3lTA9TSz68kezQ9yNunep2X7skJmcx18X2a/GmwZwWDxHXfUUlwC2dpADb/xEaL+TabkDrUYv9S7PeIoPGnPy3JhQELdzgADAGBiGJZj2AYcOlcrVF7550S/O0EEl8OOwYXgrdcf73kox+VwGrQMzQG/4FGBu26iQ1a8+1q8YniLwv57rXoGZ/ZMd1lNP+8MSpcCMNAzzhXh8HFqTFmXDgtgn/xL7KMyPpqcAuzDW7BjAFmWAuhjqpRwUmGsNtCGJG3T9eCTQFqm4oZsBDGlBJoIbQQWggthMZsNpwWQSmBA4VQ13LtzNiGRYsGl2h+dpVvgHnONTsFzLAWQh1Vo4KTDGG3hTAib5+uBZsC1DYVM2AhjCkl0EJoIbQQWgiN2Ww4LYJSAocLIQ5ALF9f8rXQVb5Aui7RVb4BFtiV2bZghrUQ6qgaFZxkCLsthBF5+3Qt2BSgtqmYAQthTCmBFkILoYXQQmjMZsNpEZQSOEQI19ZvnT9baW3T2s/6+vB0SUNs1lqOqqQkKe86q2lQlsdaYzrBDGsh1FE1KjjJEHZbCCPy9ulasClAbVMxAxbCmFICLYQWQguhhdCYzYbTIiglcDmEMJbEn3MeTw7wMynvPZ78bI7Ln8YUK9d8LU5PG0K+2lZPm3zHDT02hdU2bgHnQgjVWsEtt0iI9nyHrus4jCs0KxLs5jrX7eeC1MMbGuVsTQ+PxuCOit1r9br6jrCcvuoqCV8o0Y1SL6wk1d/HYOtX7jG7K5XJ6mrNdzTfjfnhD6sYLpGx2i7X/UmeeUYCt8QSGbUnTkiwgIaXIlARXAijwrkYBpQATwMaA6fFmDEq1D77rAT78+Z3hDFjGLA4XBfB08CzQmO8bpyLR4da+BIGCf+H4kJiP/xhyb/+15Irr5TgXyzO/chHJFdfLfn3/17y7/5dFjTGfq3XXCP54z+O4eLUGDMunFFBKYFnUgi7GuT9dP1ctvLWn8YU3oKQIxbCKdrzHRZCwUJoIbQQWggthMaYfjijglICz5gQJrV5P7LKWaOrWXMA0AA/F1Xe+tOYwlsQcsRCOEV7vsNCKFgILYQWQguhhdAY0w9nVFBK4JkRwqSqKmrznw1dzeZsv+Hy1p/GFN6CkCMWwina8x0WQsFCaCG0EFoILYTGmH44o4JSAocIYdWhSfG4/NlKfnprbSzvOp78xMHs5V3Hk4PyJ6qMWQPegpAjFsIp2vMdFkLBQmghtBBaCC2Exph+OKOCUgKHC2FDLGxtMKGpisTysk3r6bEwlqOqLGx+5uWxCoXNMX6iypgJumLO2aXBWpxL8/0x8Xstv8XXX5dwz0bYFGpBrRnExZJizNfEYOkCMWNtD69oXtX8QLM33XM1A3d01llVDDSV4O3DeMm3YlZWqpg+3tSI4uIWwM9/XsWQ/MuhWqf0ND6hSdG1KRff2AwT28jmm39ilY89G6EEjzwiefRRSd4Vdgq9/34JpA76BFF54QXJV78q+fKXJZA6dAVBwv0ieHT53pj5ZqewqZtvlmA7U7xfBJuO4roInjNeGd7RQw9J8MryYaBnPDpcCJ8Kxoyngb+r4W9yN94oOXBAcuutkv37Jdj69eDBGC5OjTHjwmlxWZmsNFiaMrT9mWYDt2B2CBbCwMUWQgthl+MpPY0thBZCC6GF0BgzE5wWtxGrxYrXmOXEQhi42EJoIexyPKWnsYXQQmghtBAaY2aC0+I2YrVY8RqznFgIAxdbCC2EXY6n9DS2EFoILYQWQmPMTHBaNMaMjoUwcLGF0ELY5XhKT2MLoYXQQmghNMbMBKdFY8zY0OIErLaLxt9OczCGXekqv2f/0nqA4508mWUgf61R+DQAbjBH9KmqDmv2SlTb8ht89VVJ35hfllxaxfzyl5Kq+h8S6OIgzs72Ly2+nAG1+S6yPQKMWkTvt2cYOVgi5xtpIk/otpNQIHSFWugTnCfvCo3zc48elcC1cAuwGmjqgw9K7r5bAhODPN93nwTOg9pDhyS4LgwQNoWuchPDC4WmojHG/PGPS7Dr5rXXSuCleFYYM+4Iw8jvCH6IR6cmRiGExX3iE5K77pLgHeFPGHiwkNgjR2K4ODXGjAunRWPM2KSGwGUuG5cSaCFssBDOjIXQQmghnMRCaCE0ZufBadEYMzapIXCZy8alBFoIGyyEM2MhtBBaCCexEFoIjdl5cFo0xoxNaghc5rJxKYEWwgYL4cxYCC2EFsJJLIQWQmN2HpwWjTFjkxoCl7lsXEqghbDBQjgzFkILoYVwEguhhdCYnQenRWPMkvGGRs0EXKBRXnlFUvhSKoRs/IQm4+23JdzOlD0LWOWDqvoHzQI5LHlfJSG/00DL8WD1Dfb0LGB1/dRTEvYM3qHJTQyNFWxDyGfVA173NySXVTFY8/ddCD1jl9H03xEWsjAirGuhXpCrXL1ggLmJ4VwIIXLsWBZc98kns8CIcPuQDdgFfOm66yTXXy+BXWAjTTgP7hc7Z+INohZ3BDPBYy/tOgbDwDvCdeHS+KDxDwmbcOJfO/5mgQsh5ecRg6eRv25cF7eA133DDRLcEc5VieXi1BgzLpxRAaY2ZETWl3/z0tvJoi5kzKJIF7LAQrgwDlsILYQWwhZDsBDG4B3huhZCC6ExWwTOqKCUwIFCqIu3FmKDrjbVDCI3I7P0M0sbY0YjXcgCC+HCOGwhtBBaCFsMwUIYg3eE61oILYTGbBE4o4JSAocLIQ5AVzmYsVkvs/QzSxtjRiNdyAIL4cI4bCG0EFoIWwzBQhiDd4TrWggthMZsETijglIChwjh2oKt82dSCMo2YUHYUpiUx6rWwqYKJcZsFulCFlgIF8ZhC6GF0ELYYggWwhi8I1zXQmghNGaLwBkVlBJ4BoRQF3gtlP00JfFgIcdNSfxpzBkFC1kk9zRF7WLyZTdAVF54oYpZKNdpTsYcOFDFFKt83L7w1luSHN6+2vKLL0o4jHPyvUA/Irm4iuF1865UzCAIg3jtNUmhfHjOChun9DT+fUzh/+BtSfqszj1Xwjs6r5JUN2oU3AIW/VgTY8Wc+wOW5nAP9AyNQWPsFIo/AOAf8Je/LHn+ecnx4xIYIG4BNwidyJ8VBAm1CJYU+Prz288bYxgYM14oNuHE5p+33Sa58UYJpA47heb3i2FA2hG8QeRLX5Lg7R9L/zqAYJB4dHjseCm4X3zPuq0oVJOLU2PMuHCWBPgvA9LHqbVQ98+S08ungln66WoztLz1pzFnlEZ+WmMhnGIhTLAQWggthBZCC6ExZgNwlgT4LwPSx6m1UPfPVlrbzNJPV5ukHLQ2M2YEGvlpjYVwioUwwUJoIbQQWggthMaYDcBZEuC/DEgfp9ZC3T9baW0zSz9dbWYsB3mtMYulkZ/WWAinWAgTLIQWQguhhdBCaIzZAJwlAf7LgMzAqeWQHuTH8Wekq1k82PDx5GfrsTEj0MhPayyEUyyECRZCC6GF0EJoITTGbADOkgD/ZUBmQNZFoTA0aW8Duk5pLUzKY1Vr4aQ8/jTmDHOWJl0T94A1ca3R2vgPoO2jf0XTGNqp8FyMuZb89rcSjooGuDfbKvPdEgzjhz+sYiAMF15YxZx9tmQQuC62A+QL5R0dkKxAriba3yRnv+bMMeRCV2pIfoOPa5Sengehd4StMu++W3LrrRL8SQNbKeJc7MlZSlEMFt8wsVxEUQvZgHnm1opgq8xDhyS6VyRrddHP4F8OniTkCnuQ4roQQgRPEsF2pvgYsBXqLbdkuekmCXTxTt2TEz1DRHFu/pnlPaMxanGhvDFq8QbxjnBHabg4NcaMCyfJZWWy7mLpGWC0CxmzjoXQQtikx5fAus/M4mlzMeRCPdqW3+DjFkILoYXwVCyExpgR4SRpjBkbC6GFsEmPL4F1n5nF0+ZiyIV6tC2/wccthBZCC+GpWAiNMSPCSdIYMzYWQgthkx5fAus+M4unzcWQC/VoW36Dj1sILYQWwlOxEBpjRoSTpDFmbCyEFsImPb4E1n1mFk+biyEX6tG2/AYftxBaCC2Ep2IhNMaMCCdJY8zo5EvkvBYMapyCxfcuzSBDoPMc0ID0FtjVmQODTEeVM2zM+YX2D3jsOT3vF+SjymtHY45hwPGwyocQlhqQBOdiWQ/3QLC8LhvE5P6AYJWP5HaRZ9C5GDPuCM4A9yifQAwal5eOgeTkRoSeB40qf6HlwGKw2Sm+K+TmmyX4JtEVvg28wTx4g/kgUatdcXFqjBkXTovGmNHJF7J5LRjUOKVHGPYPMBMaEVwLpLfArs4cGGQ6qpxhY84vtH/AY8/peb8gH1VeOxpzDMNCGKMrddbmGXSuhTCmHFhM7lqIhdAYMxBOi8aY0ckXsnktGNQ4pUcY9g8wExoRXAukt8CuzhwYZDqqnGFjzi+0f8Bjz+l5vyAfVV47GnMMw0IYoyt11uYZdK6FMKYcWEzuWoiF0BgzEE6LxpjRyReyeS0Y1DilRxj2DzATGhFcC6S3wK7OHBhkOqqcYWPOL7R/wGPP6Xm/IB9VXjsacwzDQhijK3XW5hl0roUwphxYTO5aiIXQGDMQTovGmNHJF7J5LRjUOKVHGPYPMBMaEVwLpLfArs4cGGQ6qpxhY84vtH/AY8/peb8gH1VeOxpzDMNCGKMrddbmGXSuhTCmHFhM7lqIhdAYMxBOi8aYrcyTGuWDGmwNOhf7swy7kGwNykpQa6BecJ7qBQ34kARjvkTTQ3oL79NcriGTnVebKLC48zTVNRogPUOIyLma3Wnw9qma92qUyYtrgv1a2ZXyDg0aoysEK3Xsb3n//RLsuolaBDt2YptNXAhbdGL3SwTbbGJUR45IsNnpgw9KoAQQFVwIO5R+8YuSY8ckaIzr5k8Dw8CDzbcGvffeLLgu9nrFHT3xhAQ3+NRTkmeekZw4ITl+XPLCC5KvfEXy5S9L0BW2UcUt4KvDo8NzxpPER6jaxk8FqgkRvfHGLNqYi1NjzLhwSgX/639lGZHJ7u4snYN5emvOXfiojJkTC6GF0EJoIbQQFhJoIWyC54wnaSE0ZkfCKRWUEjhQCNf/H3Vl4jRjGxbNxzwdxnPn6ceYhWMhtBBaCC2EFsJCAi2ETfCc8SQthMbsSDilglIChwshDgDKZ2w2P/N0aCE0S4uF0EJoIbQQWggLCbQQNsFzxpO0EBqzI+GUCkoJHCKEs8jextpEuqpay2NJ13HZGOVlVfxpzCZiIbQQWggthBbCQgIthE3wnPEkLYTG7Eg4pYJSApdGCFuPp43Cz9Y25cHkuOus1uOmJP40Zj56FsEHY06erGJ+/GMJ3eP9Gl3HX3SRpGfhPsjx3qtR3n5bwp5rDYEvIXs1/1Wi+lTXkj7kQpP/KDRQkPSFovFbb1UxPfBjENAz5eoiDTkcc/31VQxdi8Yr32RRq2+hlheKD7h6twR3BKrqYU0ORnVSgu0Qsb8l5AqLbwgDDOHppyW5P0A2jh6VPPmkBF2hMbrChZ59VpKPGTcIX0JjXBe1eWNIDu43v30EN/jccxLIFZI3htShMRwPw0DwJL/wBQnuN39WeEd4zrgubgHmiVtABj2N55+X4Fz9Jrk4NcaMC+dMUErgooWw0mUM69bI++k9q7XBpDDvqquH/Kcx86H+UNEBZPFtIUyjKmIhtBBOYyEMycdsIYzJFchCGGMhNGbrwDkTlBK4aCGcv038GRYLpygbNMQGKIw05WiW/DRmPtQfKjqALL4thGlURSyEFsJpLIQh+ZgthDG5AlkIYyyExmwdOGeCUgKXWAhnLI+FXaeAvFnXWcZsCPWHig4gi28LYRpVEQuhhXAaC2FIPmYLYUyuQBbCGAuhMVsHzpmglMAhQlh1WFnXcfmzAafEbrsukbcpDybH+FmWd7UxZkGoP1R0AFl8WwjTqIpYCC2E01gIQ/IxWwhjcgWyEMZYCI3ZOnDOBKUEDhfCMH1PC0OT9jYAp3edEgtjVdk4OS4bozxWoZkxwzlfQxN7IIb+cAl2v7xeo4vgyyoJ0YV76h655LAxBGkY+zQCr1uLbAzkDY08DV4Iz4pvIUfPVdcqLpSj77fW20eG8ZpGL1Q9I1lR84SnoXbYswLHNRiVsGePhMOojkiwNMfiG7KBWgRL5NwBsKzHJpyPPirBTqGo/exnJY8/LnngAQkuhI0l8/08ocf5NqroCsEdIXg4eHSPPSbBPqJQegQXwlaoUGtcF+qFYQwaVb7nKh4sRgVdRC0GCdXE7WPTUbyjfFT46vBt4Fx8ZnffHcPFqTFmXDCHLi1xdTTDMmkkZluzGZNjIczYZyHsRt9vrbePDMNCaCFcj4UwxkJoITRmO4I5dEswwzLJmC2EhTBjn4WwG32/td4+MgwLoYVwPRbCGAuhhdCY7Qjm0C3BDMskY7YQFsKMfRbCbvT91nr7yDAshBbC9VgIYyyEFkJjtiOYQ40xo2MhzNhnIexG32+tt48Mw0JoIVyPhTDGQmghNGY7gjnUGLPZ7NKcI4EwvOc9VcxAsLxWag3g8jrnBgnPzdXrRc1TEnYlKlJ0BVtO0cdeoPaIxhwVSC0O6MdQ3NG+xJZ7qNPrvkfTwwGNosZLhvlhZoB0vJ6vTslXvfki+KGHJPfcI7n9dglqsRbH/qVY5cMBICoIuoJcwRCOqdPmW5KiFgKM/S1xC3hWMIQ/+RNJ/lLyhwOH/9znJPkbhKfhHcHxMGY0vu02iSoQLwTxhlviFiB1MDF0hRscVIs7QtAYnxk+lXQLVi5OjTHjwmnRGLPJrC39p1HZgBJYCLUrC+HM1Ol1LYRJcp2wEFoIm1gILYTGbBE4LRpjNpm1pf80KhtQAguhdmUhnJk6va6FMEmuExZCC2ETC6GF0JgtAqdFY8wms7b0n0ZlA0pgIdSuLIQzU6fXtRAmyXXCQmghbGIhtBAas0XgtGiM2WTWlv7TqGxACSyE2pWFcGbq9LoWwiS5TlgILYRNLIQWQmO2CJwWjTFLzVnp9p5c9X5PI/Scm6eHAaJy7bWSqnpJI3DM1QuSKysJx/wDDRAv7ZEcugfQ219zuWlycn3KgZe+SwNqDfm8Ru+3/B7kOQ/i9wvLPMPAjp3YaBEOgMU37ALbe2IHSyzrsYCG1UDqcF2MCvuIojZfxyPYDBMac/CgBGbyyCOSfFtRON6gXVVxv/mFcPt4OBgzXihqMQy8FDjenXdKbr5Zgj8WYFS5DyMYBkwbo8Kjw7PKG2NUSP4P5447JPrHES5OjTHjwmnRBH6yBktnY8YT57mE2ZFYCOOYLYQRC+GGh4FVfr6uxeLbQhhjIbQQdv3DsRAas8RwWiyYGEtDV/lPOqymtUFX4w2wwK5Kks6TqgldDcryssSYbiyEccwWwoiFcMPDwCo/X9di8W0hjLEQWgi7/uFYCI1ZYjgtFkBXmp+zaMw8587IArsqmafzrnPL8rLEmG4shHHMFsKIhXDDw8AqP1/XYvFtIYyxEFoIu/7hWAiNWWI4LRbMI3WtbX4SaEqa8uZnQ/w5adOUND9jyemm+nNygJYNkxKA8snPpn2snRQ2NIWxqmw5KWnK409jurEQxjFbCCMWwg0PA6v8fF2LxbeFMMZCaCHs+odjITRmieG0WNClLrM4TFebss9YUtY2B/EYB/nPeC5+oqoBhWjWenrX8eQnDiKthWbncLWkXlugN8k5V0OreVyjXDJgg8eTJyU955aSEIIFFTWmh19IzqskSmGP4g+off31KqbnLeCmiIqKOjzgg+UdQa31/ebDwHXxnCHPl2mq/Zocled8VPmXo/DhDDkXw8AGh3wa+CjhANA27GB5TLfoxAae8MPcH7C8hsbcdVcWyAYCx8N1YRe436NHJbhfSCzOxaajCM5F7XPPSVCLYaAWY8Yrw76pqEVXaIwx5+dim00E52LM+FTwMeS7m+L9Yh9RfGb42mFxcNqbbpLccosEo4JM4kL6L4WLU2PMuHAOLZiITUNX+U9CVaS1ARrP+BPlE7oa42dXeevPCXmb3p5nLJ/QWmh2DldbCC2EFsISPpwh52IYFkIL4TQWQguhMUbhHFrQ5Spd5QldUjTjz9YrdjXGz7IcxNoJKOz6OWf5hNZCs3O42kJoIbQQlvDhDDkXw7AQWginsRBaCI0xCufQgi5X6SpP6JKiGX+2XrGrMX52lSfkp/T2PGP5hNZCs3O42kJoIbQQlvDhDDkXw7AQWginsRBaCI0xCufQgi5X6SqPzChFyc+frNF6jIPyZ2v7smryszmOJG1iz13HkwP8RHlridlpXG0htBBaCEv4cIaci2FYCC2E01gILYTGGIVzaEGXrkzkJ8IWa7Q2QEmsakqaBrE2ls9S0pTHBk1JbNlKrEIzVEXKBvEnmsUqs2PRVT6W18g75tiFcpdmt6Y6rFFqDaglcK3iQgIbX5Iu+rGOB3Ptq/mq5nWNvCOOeRiPZ5YOVlK5qr4u2VNJwKUacr3k8krSc648q5WVKgawVq01r+XTwKdSayZfSBPUnq2BxcFqsAknNks8cECCPTmxCIYfwgGeeEKCUWHDUnSFcyEb0BiYyTGVK5yLnmGPcA/4w623SqATeFZ4zjCixx6TYL9WjAo7Z6JnjBmNcV1sOppvKouNYTFm9Iy9QPONUiF1uAWcm+/2CW2DH+ZPI/9jAR4OPrMvfUny0ksxXJwaY8ZlfZY2LcDcZmED7YeeYrYfpxzDQni6MVb5AKt8YCGMAZfmUmchtBBaCNsUqJRAC6GF0Jhtx/osbTZOY3S2O7MxTjmGhfB0Y6zyAVb5wEIYAy7Npc5CaCG0ELYpUCmBFkILoTHbjvVZ2szFRAVtg2ZjnHIMC+HpxhbCyIqF0EJoIbQQWgiNMWeW9VnaGLNpnHIMC+HpxhbCyIqF0EJoIbQQWgiNMWeW9VnaGLNZcKfQayTvrCTV9yVYE2PFXGsu1HxAU/2lRgVpdyGQMedrrtJwB8vfaBRYTXmt2XOeBrr4bg1uIb8jCNLlGlwIjx1d4S3gWcFquOnom5KV1B7xYHGD+bNC8JzzJ5m/lA9qcCE8K+R9muoOCR5d/iS//vUs//k/S/7bf5O88orku9+VfO97ku98R/Jf/otEl8hcQH/lK5L/9J8ksDgs3HNvgVyhFiIK9YLxYr9WGAIulCe3dNwRzkXjQecO6grBubgF6NMXvyiBeKMxuhoUdIULle2T4FwEf3dA0jvi4tQYMy5cMxhjxsZCGNljIbQQrgfPCrEQWgi7pK5UtdnPHdQVgnNxCzAiC2EIF6fGmHHhmqEg/q/jfLy5x2abYiGM7LEQWgjXg2eFWAgthF1SV6ra7OcO6grBubgFGJGFMISLU2PMuHDNYIwZGwthZI+F0EK4HjwrxEJoIeySulLVZj93UFcIzsUtwIgshCFcnBpjxoVrBmPM2FgII3sshBbC9eBZIRZCC2GX1JWqNvu5g7pCcC5uAUZkIQzh4tQYMy5cMxhjxmayfO8K2JNm0LIe6/jJer0JhFDNk9tsXqqCVL0owajeo4EvVf+g+ankbNkc8tJLJVX1i5if/rSKqd4xZINWvoWvaH6tUWBEg6C3KNh1Mwd/SsDfDvKQxyUcpP6RAtvV4rvCR8iulEs16ApCiFr0jJfyAQ1WvenKlbVY1qO2XDTH4FzkxRezvPCC5PnnJSdOSOCW3/iG5JvflHztaxKci+C6sNY/+7MsX/6y5NlnJbniQkSxNya22bzvPgkaQ2JxIWyVift97jkJanGDeHT5Cz1+XIILoav8TwkYBt4vzi2/tBgMAw9n0L8FvV8uTo0x48L5V2n+B2ytsPUOZvjO88Y0rKQBe9JYCC2EDRbCGAthjIXQQmghNMYEOP8qVECFrQtaNSkWypKyrTCWlw26ysuqCWV5WbIxFtWP2ZGspAF70lgILYQNFsIYC2GMhdBCaCE0xgQ4/ypUQIWtC06vFTtKyqq8vPzZdVz+7CosSzbGovoxO5KVNGBPGguhhbDBQhhjIYyxEFoILYTGmADnX4UKqLB1wem1YkcJqhrK8uSUpKqkbBNLJmObEJrMVB6rugqbqqbQmDVW0oA9aSyEFsIGC2GMhTDGQmghtBAaYwKcfxUqoMLWBRP5aRSo9WdJWZ6cklSVlG3i6V3HkwP8TNr3HhsDfqj5sAQrdV31vvaahIvglJMnJXTLHj4vgfJhaY7kq3yI6JWVpDqhSWHPv5LomCf/RBt4RxgGnJYXAj+Lede7qpgecgO8XFNdq1Eu0FR7JbsqCWQSrwy3f6FGpb16rwYmhq+9ulGCxu/SrGgwKjTGHqS4X+wjCqvBihmLfuz2ieRdoTHW8bgQgqU59AlyheBc9IxBQiewrMcepA8+KIGYYXtPqBd6PnZMgmHgFrCh5ZEjkocflhw8KDl8WIJtVEtRj8EdQTVxXQSNobh5MEg4LW4ftQiGgTz0kAS3kNcOuUEuTo0x44IlA6ACKmxdMFGgRoTwc3I8XYCFwuYYJUnV5LjsLRIbNDRVaBl/NvS2n7HcmIiFMMRCGDnLQmgh7IiF0EJoITTGLAgsGQAVUGHrgqhD8XjaIpA0mKUKtJaXhRhhJLYpy2OD+BONY/m0tTGKhTDEQhg5y0JoIeyIhdBCaCE0xiwILBkAFVBh64KoQ/F42iKQNJilCrSWl4VJzxNQ3tW+q7yhq9yYykIosRBGzrIQWgg7YiG0EFoIjTELAksGQAVU2Lqg1YKaQtT2lpc/u47Ln12F8aKtvaGwtX3X8eQnDowpsRCGWAgjZ1kILYQdsRBaCC2ExpgFgSUDoAIqbF3QakGxUBZgbYWxvGzQVV5WTSjLY0nX6bEwVk1br9eW5bGwOTZGmchbE6hIdb0EfohFcHW15Hxsd3mDRnsGWNZXt2l04f4O3cDzXE11QHJFJYHGcMx6ITgAHl11jWSiZ03O0kA2PqjBc8a58KX3a/Cs8EKRqzQwzz2aCzRojLeAnnEuPA2+hKeBrsDFmss1/ET1QhgVXhlqcSGM6gp8V/s0a/8i1sO/hmABnQfL3LJB0hgL6LwWooLgXATDwPobtaWrJMt6BGaSX6g8PQm6wqgG3SB6Ri2SyxUCHx70NHBHeL9QawSfSv7l5C80/65wbp68K9z+5z4Xw8WpMWZcJvO5MWbzsBBaCJtYCGNQiwthVFdYCEMwjEFmgpSdxwxSoPL0JOgKoxp0g+gZtYiFMAbn5sm7wu1bCI1ZJibzuTFm87AQWgibWAhjUIsLYVRXWAhDMIxBZoKUnccMUqDy9CToCqMadIPoGbWIhTAG5+bJu8LtWwiNWSYm87kxZvOwEFoIm1gIY1CLC2FUV1gIQzCMQWaClJ3HDFKg8vQk6AqjGnSD6Bm1iIUwBufmybvC7VsIjVkmJvO5MWbzsBBaCJtYCGNQiwthVFdYCEMwjEFmgpSdxwxSoPL0JOgKoxp0g+gZtYiFMAbn5sm7wu1bCI1ZJibzuTFm04jbEJW7D911l4Siski+r9krqSsJgJmsaJR//EcJe0aqwxLahYCe8web1/7qV5KC/OHoRqlKfl3I5D/8QxVDjal+p/mF5FLdGhRPUkHPV1whAbyFWm7/ooskbKzD+OUvq5hikL+JKbrK+O1vJT212KIT+1s+84wEG1oePSqBEmAjTez2iW1FEexB+tWvSjAqbNGZ70Gqa3HeAgJB+sIXJLguHg6CxoNGhf08sdvnY49JjukbRC3OzW8Bo0I++1kJLoS3j6Ax9Ak950+y3P40eTh4ofhi8ZxxLgQYg0Qt9pi1EBqzxHCaNMaMTL7MtRBKLIQWwmlXGVS+vNZCmMRCmMRCaCE0ZlvAadIYMzL5MtdCKLEQWginXWVQ+fJaC2ESC2ESC6GF0JhtAadJY8zI5MtcC6HEQmghnHaVQeXLay2ESSyESSyEFkJjtgWcJo0xI5Mvcy2EEguhhXDaVQaVL6+1ECaxECaxEFoIjdkWcJo0xoyNOh6XqgBbOCp//ueSPxRohGJ5vU/zecmuSvJuTS0pelbWm83SGD5cGNFJyTnYdFT4zW8khPqkpD33cUgDoEC3SWp9XAq0rXg4A/j1ryV9tRiz3mAtY+5TTe1KzyU1aiHeezVC/plxef3885LjxyUwIqyYIQx/+qcSrNTRcx5IDsaM62LRj4U7RgUHwLn5LeRdoTHGjAvhXPSMHTvzG8xFBQr0wAMS7JyJ7T3vu0+CczEqaHku/F/7muTLX5YMevtwSyT/mwXeQv7l4ONHLR47/uGo4nJxaowZF06LytEUtl5WWmb/zWBJhmGWDwthd2MLoSqQYCG0EHYqQe5LGBUcAOfmt5B3ZSG0EFoIjdkKcFpUqIAKW3fQNQW3ljeFsaq1MNLaoDyYhbJxWbIxFtWP2XZYCLsbWwhVgQQLoYWwUwlyX8Ko4AA4N7+FvCsLoYXQQmjMVoDTokIFVNi6jTjzDj3OCyN5g7wWlI3Lko2xqH7MtsNC2N3YQqgKJFgILYSdSpD7EkYFB8C5+S3kXVkILYQWQmO2ApwWFSqgwtYFLdPuGmV5U1JWdRVGWhu09jldELSdUrV1Ncvps5THqq7CpqopNDsAC2F3YwuhKpBgIbQQdipB7ksYFRwA5+a3kHdlIbQQWgiN2QpwWlSogApbF7RMu2uU5U1JWdVVGGltUPYZVwLtq4K2rlpPwfHkAD+T9r3HZidRSybfQQNXzNVPY3pW29pzVR2RsDZnn0aZaFITBXfEQeJcqKZy7bWSAlWCOr3BdMzzgPult9Q6qlStWZuzIvnbv5XgQ3rXu6oYXBdrwuIj/HlMIaLwtP+qUWpN9bBEa3/xC0lVvRXDYaDn3RK+IyzcX3hBgnU8dgrFehordayY8WSxyseum7piZi0u9IcpOQaGgLU4anEu1vG4BQSNc0/LXRq1kEmMGefiQngpCB77009nwSvDs8KY8cpOnJDgu8KHlN8vhoG3jw8YXSH4QwMuBF3MHQ9vIZd29KzX5eLUGDMuVcrRFLYuWFsLtVCWNyWcprsLI60NkoPWn01hSVOFlvFnQ2/7GcvNjqGWTL+7NYq1uIXQQtjBioXQQrgerPLhLai1ECbBK7MQJt+GhdCYLUuVcjSFrQvW1kItlOVNSVnVVRhpbVD2OZ3+15m2XqcsbEp4cmjZWh4bxJ9oHMunrc0OopYUHwfW4hZCC2EHKxZCC+F6sMqHt6DWQpgEr8xCmHwbFkJjtixVytEUti5YWwu1UJY3JWVVV2GktUHZZ2szULbpPR3lXe27yhu6ys12p5asKsVa3EJoIexgxUJoIVwPVvnwFtRaCJPglVkIk2/DQmjMlqVKOZrC1m2sLYc2eJwXRlobNIXxYAPX6j0dha3tu44nP3Fgdhi1ZPJ9NBRrcQuhhbCDFQuhhXA9WOXDW1BrIUyCV2YhTL4NC6ExW5Yq5WgKW3cwnXNnKC+bdRVGWhs0hbG2uWjrKVVbV7OcHgtj1bT1em1ZHgubY7ODeP11SU7e+J57JFiaYw/SH/xAwkW/LqCrizXqpVX1FxrlXM1Zkr/5GwngKh8WV0vQmOZJGrk9lfhvcu2foj6NWi7Exqptv/ylBPSMqtaow/Np7Eq3fj1Pgv1aq3dqQI1hfFNyqe7IysYKxftvJHV2vxdeWMUMo5bwlcFascyFXWBNjLV4bo/YsBQLdyzNsbHkV78q+bM/k3zlK5KXXpLguhAV3BEECeci2BsTt18KVQz0CU8yHwb06ZlnJLgQDBAbhx4+LMHrhrfg20AtPA21GAZkEm8ByUUUJgblw7PCnxLwnPFN4sHiXHyx+YXy92shNGaZ0BnUGDM6ueOBvLGF0EJoITxNLeErsxDGYKWOcxELoYXQQmjMtkNnUGPM6OSOB/LGFkILoYXwNLWEr8xCGIOVOs5FLIQWQguhMdsOnUGNMaOTOx7IG1sILYQWwtPUEr4yC2EMVuo4F7EQWggthMZsO3QGNcaMTu54IG9sIbQQWghPU0v4yiyEMVip41zEQmghtBAas+3QGdQYs/ncG/Pzn1cx1YoGDlBjea3U+RJZFOiv/7qK4XWVoisBXdFqqpclqjGwxx4GNYbyVS9qBN5gnT5n5cc/luRPA7pYPKvXNBuHd6SC9LOfVTEgry2Q51zc0WTr0fVcUknSr666UJOC+6WWYx2PpTmUAGtxLPpRCwXCihkagxVzXguN0eU1h4HGqMWoYI+4QdjUnXdm+dSnJDj3yBEJnCe3KSgQarHdJeQK10XjvGc85/yF4kPCY0ctPhUE10XQFW7wwQcluF983jgXY4bj4cHiy0GO6QesN8jFqTFmXDhrGmM2GwuhhdBCaCG0EFoIQ0oJjEFXuEELoTGmD86axpjNxkJoIbQQWggthBbCkFICY9AVbtBCaIzpg7OmMWazsRBaCC2EFkILoYUwpJTAGHSFG7QQGmP64KxpjNlsLIQWQguhhdBCaCEMKSUwBl3hBi2Expg+OGsaYzaZOpMNrGtZXePc4xoo0N/HsGesxREAL80b79FUBzWHNMo7JYVdANzvY5J67RE1qR6O4Z6caePJxaZgX008jfdL+Nh179PiujkPxLz2WhVTVb+Q5H9KQC3Bg1VqjPn7knmue5HkIg398GxJz6eCJfKjj0pgNfffL8G50BismLHKx4oZ7oFVPmpzX8I6PvcH+DDuCLX5w4HyYXtPXLd0hhi4VnSJPwSNsTcmdijF1q/YkRWbu2LfVGykmSsfXjfeAh4dLB2PHefiQqhFV2gMx8M7whvEMCCTaIwL4QaR9DPj4tQYMy6cFpXV/5llK7K24hqPkS9ntgU11tNC4Q9KjXMthDEWQgthx6eCRTAWslgEWwiTh2MhtBB2Jf3MuDg1xowLp0WllMANCGFY6vSDZjOeNTutHZaFZcnGWFQ/ZidRYz0tNP+cJrC6xrkWwhgLoYWw41PBIhgLWSyCLYTJw7EQWgi7kn5mXJwaY8aF06JSSuBQIVxb4bQcdzFLm3lo7b8sLEs2xqL6MTuJGutpIbjDKVhd41wLYYyF0ELY8algEYyFLBbBFsLk4VgILYRdST8zLk6NMePCaVEpJXCQEK4tb9pLilUQC9G+tbZpUJbHwliONl2FOKXsZ8byWNVV2FQ1hWZnU2M9LcTPqOWjqXGuhTDGQmgh7PhUsAjGQhaLYAth8nAshBbCrqSfGRenxphx4bSolBK4WCFsPZ4c4GfSPp4ySz+xvKuwtX8cTw7wM2nfe2x2LP87ZvJNNGA7RNSyp+ouCcykB1nlHzhQxdAB8mU9gnNZq9RprfL970vy+2VjhdtO1pK+xz6Aoqt9GiW9o1dflQyjxnN+WZK/35yzsr1ev/c9SR/5l/PNmHvvrWJogNi9FmCpmi++ISq5xmBXxuPHJZAcBI6HrvLNIbHoxx3BH9AVrAaNYUS5tsHTILEYJFQEMgkVeeghCW4f5+L94o5g6XhWqMUtwLRRi28j378UbyEP7gifKEY1RMz4YPHnD/jhoUOSBx7Iggvps+Li1BgzLpwWlVICFyiEZ7QcdLVvCkuaKrSMPxt6289YbnYmFsJAndYqdLz0ftlYsRBaCKexEFoILYQWQmN2EpwWlVICt5AQri+4TlM2aCgLY3sQ25TlsUH8icaxfNra7FQshIE6rVXoeOn9srFiIbQQTmMhtBBaCC2ExuwkOC0qpQRuFSGcsbyrMG9fFeVd7bvKG7rKzY7CQhio01qFjpfeLxsrFkIL4TQWQguhhdBCaMxOgtOiUkrgICGsVHhw3PzEcdMm/txA+1jYWt5QFrZeC+WxsLV91/HkJw7MTsZCGKjTWoWOl94vGysWQgvhNBZCC6GF0EJozE6C06JSSuBQIazC+qe1EFUoaa1CYXOMn7FxU472XYWt/aBZLIxV09brtWV5LGyOzY7lVc3BGK5ra6yJdQvH3ZUkhT1foFHi59v/1a6ku4yer7lMU0tw3UsuqWJyX8IN3nOPBBfilpXkHkmdDVJPrF55RYJzAbyU76jaK6kHDGNYY7CCF/qkBNt7DqEYhhpg9Z0YNKbD5+gOpVV1QJKv4/OFO5bX0Ak4D6wmFzOs49EYF4ICQeryO4JqYl9NaMxzz0mgfPBDCDB6xi1Ek/xDcL/57efn4n4RdIVHl/85AE8Du5ueOCHBW8BXh0BE8Y7QGIPM5RlSh5TyGQPVxHXx2PNhaC0Xp8aYceGkORZrU78x5hQWQgvhaSyEFsJpLIRJBp1bSmAMurIQJrEQGrNN4aQ5FmtTvzHmFBZCC+FpLIQWwmkshEkGnVtKYAy6shAmsRAas03hpDkWa1O/MeYUFkIL4WkshBbCaSyESQadW0pgDLqyECaxEBqzTeGkaYwZHQuhhfA0FkIL4TQWwiSDzi0lMAZdWQiTWAiN2aZw0jTGjMy550oKB9Alcq0re1Dni/5DktQAq+pITDEqNRMFjbFwL0Y1iH+KybvKa8G110oGnVvt0ZyVbbNZXarJUY3Zs0dSvUejFLfwo5jiharxVr+R9IxZP4Z6nk80+9rRGMzjpXQArLbhD6iF5ECQGkWZBLXwJagX3ANdYVS4BdTCLmAmWOVjGKiFPuFCpbklYpbrBEwbZgLTxmaYcA+8MljcCy9IvvQlCaQOtwBpx8PJH13eGHeE94ungRtELd4+Hjtq8YlCcfHF4uHg3wJGlf4r4+LUGDMunBaNMSNjIRyChdBC2I6FUIJaC2GMhdBCaIxROC0aY0bGQjgEC6GFsB0LoQS1FsIYC6GF0BijcFo0xoyMhXAIFkILYTsWQglqLYQxFkILoTFG4bRojBkZC+EQLIQWwnYshBLUWghjLIQWQmOMwmnR/P/snQ/MVeWd55+4rDHGNa4xrjFu47Cua1zH7RDX6bjWvuM41nE6juu4jmOtQylaaym11m0dtf5XRIqICIqIgIhIUZGyHdtxW2spRcq4xpDGGGuMawhLjDGGGNNMmneVC4fn+3nu+d17eN/33vfP95tPmnvP85zz/DkHzvO5mKeO0+MsXix0yvnCgKyYYxOLw24MKEcpKEUOCHcZPU6J06HyTKVR1D0+nYRThIULBdrUQKO5CjeGxbkHCBdeKEyfLqR0oRJ72ivKKkWyZYuAUMzCzJ8vFLkmh/Mc/gyBAca94h8NqEgjUUEplvVYmgPYxR2qfBBCLM3nzRMwswsWCHiCUTl2HowICgRgYpgryAa6sWiR8MADAoYAi4N74A5CVODDkBzcBZx7111CI4eHAaIbuDKsFaXoFbqBO4inLp6r+O6jMvYR/Z//U5gxQ8Cjopfi4tRxnN4Gb0lkcN26ANYepynXEq3UHXecZqGJdYiFMI+F0EK4NwNC3Cv+0bAQWggthC3iu4/KFkLHGS/BWxIpJbCpEAZv5C6DE/f7OlXyLlVhpSx1pXXHHadZaGIdYiHMYyG0EO7NgBD3in80LIQWQgthi/juo7KF0HHGS/CWREoJbCSEeAuXL+Vusn9ndZMur1xXre644zQLTaxDLIR5LIQWwr0ZEOJe8Y+GhdBCaCFsEd99VLYQOs54Cd6SSCmBQxHCPHVvahzMau07UlbGwbyoOl6mLK3Oyovygzjetk510HG6Ck2sQyyEeSyEFsK9GRDiXvGPhoXQQmghbBHffVS2EDrOeAnekkgpgcMihPkLOviMD+Xxjp9bX6vPSN2V8bXu4nUHq8+O01WKVa+Kiu4zecEFQnHuJTlYMRZZKKiKdDh3QDlRQK9iqECHKOnWnF27Ug7P1V6xoTCsjCufrMTR2eDulyhl3lMQ3Qv0iBTBXJlzzDEpBwNkaXpLuUoRi2Oz6ffKSmWnsl3RTFLQKwz/AOH55wUGq+1qBd8i3B2Ra+JvflPAZpgA+gSwNIe3xMoHX4LyYby33hqBXTfvu0+ApuJcOADMBIKEyrALVEbpzJnC174mXHGFgMq4vzCx++8XMO0wwGuvFeJO4qcEPHWQZyhfPM94JtEuHlFsZ4pzMSJwzTUR8dOu7XJx6jhOb8PXoqaUwEZCmPYKEjQJypTbVH687cG6yh2PlwmKUhcXLD+0/eo4HUIVsRBaCC2EFkILoYXQQug4Tq/C16KmlMCmQpgnNygEFfLgYF3ljsfLlEX7OrQ71UHUKT8g+2o7TsdQRSyEFkILoYXQQmghtBA6jtOr8LWoKSVwuIRQS/ak7XEcrLtIx+Nl4podL1h+cJz9CVXEQmghtBBaCC2EFkILoeM4vQpfi5pSAhsJYaBSeVHb4+WH8njd59aHtl/zBDWDi5cN5Qfz447TVagiFkILoYXQQmghtBBaCB3H6VX4WtSUEthICNNeWYIydXO87kjbIhysPpdf85RF+dWq0upgVVQdzz+XFRyny+gSWReyRc4XuESeIWjpoYcKXEBz0Y91PEq1Gx2yShjSAH+aE49o2zahw4g4G5JNmwQG556qhFdOhwn0lniujlfiymmHgqjUnZCE9LZwZBJoy5C6iwR28lpFUnipOG06KeVw41BMjv5WwspYuMMQbr5ZwL6LsS6iMi7VMr0KbDsJ7lBhiPeojCvHdgFQGZfCEDDAuKFG56IUEwt9gsRC6rC7KVwaP4bBw7G9J+YZfggtB40uhWlHaVwZk4OG4iujckzZkwDtFRenjuP0Nnj/Oo7T+1gI88QDtBBmsRBaCCsshBbCusoWQsdxOgXvX8dxeh8LYZ54gBbCLBZCC2GFhdBCWFfZQug4Tqfg/es4Tu9jIcwTD9BCmMVCaCGssBBaCOsqWwgdx+kUvH8dx+l9LIR54gFaCLNYCC2EFRZCC2FdZQuh4zidgvev4zi9zyhZbSMXKkh05U7nNkp8qR8pGszGIdi/VLJihdAh4aXotJOTQJcWuI0qb+ilSnwXkKXKdEVzkMK7EN8UzRFKPHXY3PUUBeHkTBN0CNOmCSmdLWCpGssVRKXRahu7fcIQcC7cEls4YiPNq64SZswQsM8kNpZEKc7FlbF1JPa3/O53BWykiZ1C417B0jEbcEtMLFwrdjxsK4qHAe1iE070GWBX1euvF6C4mByci4kFeDawjyjmGaVf/3oDyo1Gc2D4GC8eFX2QuDh1HKeLnPDj/zdc8A3rOE7PYyEMEl/KQhjcBcRCaCGsUS+UWggthHWUEmghdJz+pfS6/YZvWMdxeh4LYZD4UhbC4C4gFkILYY16odRCaCGso5RAC6Hj9C+l1+03fMM6jtPzWAiDxJeyEAZ3AbEQWghr1AulFkILYR2lBFoIHad/Kb1uv+Eb1nGcnsdCGCS+lIUwuAuIhdBCWKNeKLUQWgjrKCXQQug4/UvpdfsN37CO4/Q3J58spDRXwCL4eOVghStm2Vdz6tSUU6zUn87Be5+V2dCrglb+l38RUlonfKymOWmToJfC5p/r1gmovGyZQPHWyh9+KHBEkBzcBWgeKqdXcg4+OOWgGyltEA5MQjorZ+XKlFNo228URFXzBNlldMMGAZ084gghpfkCRnSGEj4qAwNCSlcIWnnHDiHuxm9+I6TLLhPOO0/4/OeFz31O+OxnhbPOEr7wBeHCC4UvflH4ylcE2AUW/bFdAKgmfAmCBCOC08KHcWWUwhCwNSikDuDK6CQcD2r9/e8LjQaIPmNEsdIvWiTE+5cCeCmuHG+UumCBgFL0GeCmwMPhpagMMJPxk6M/uwz+6v8aY/qIrAiK0EQ1rO04ztBjIbQQ7sNCmGEhtBBaCC2ExpiRQFYERaiAGtYOMzg4yEPdZb9PdJwxGQuhhXAfFsIMC6GF0EJoITTGjASyIihCBdSwdpj99rr9PtFxxmQshBbCfVgIMyyEFkILoYXQGDMSyIqgCBVQw9r1GcwSHMxLUQFFjjNuYyG0EO7DQphhIbQQWggthMaYkUBWBEWogBrWDtNW9tp+rvvgOOM04VIV725ULrJSoKdJXnxRoBKkO4Vjk4CGJqUcLANSulo4LAnpBQXRhjTY7xB7VFJUjg2HQNeSbNkirFkjHH20UGSb0JLGCs177wkQs5RmKyLtKS0RJsvuprgpixcLqJzSnJy48tq1AuYKD+EppwjU8pOEM88U0umK/lnAwpW3W7tBXYQwYONQiAp2g8R+j/EulNjgEZWxcSiIz40X7ugz9nuEamKX0XjD0ninUOxReeWVEV/9qgA9nqYbxaIytkJFu6gM/7/kEgG9wtRBU/GoqOTw2cA9wl3Ar24QM/xlh2cD9wiPChqCmOHhv/de4b77BCjuQw8JDzwgoBSaqgJcLk+NMb1k30KkXaiAGtYOUwph26/BB8cZp9F1rYVQow1pLIQWQguhhdBCyHtkITTGNGTfQqRdqIAa1g5TGiCCovxr9dlxxmN0XWsh1GhDGguhhdBCaCG0EPIeWQiNMQ3ZtxBpFyqghrXDwOvqNK86Xn5wnHEaXddaCDXakMZCaCG0EFoILYS8RxZCY0xD9i1E2oUKqGHtIsE/9NX9M2DwwXHGaXRdayHUaEMaC6GF0EJoIbQQ8h5ZCI0xDdm3EGkXKqCGtYtA+UoJxMG8tPqKOo4z/qLLel1tY79DlKY0I4cKpJXPPVeIK6fjhGOPFVD5gAMELvqpQL/PYTe0MrYDRKAiKa3IOeGElANrLTJTkVA20s6cuCFMTrH5p+SttwTkuOMECFLRkAR3f5quridNElK6SNEMKhpsjpgOEoqGrlCQ6KYUc3V+TtFQdCmsTbmuffhhAfs94jcbKAH2AoWnwS5g7Vi4o/SmmwRYK/YRxV3BppTxDpYwBOxf+q1vCTAx+CG8BZIDt4yvHGtq3I0rrhBQGW6Jc9EQXAu3G8Atb7xRQCn+0kEpVDO+MirDPGGPGODllwuNxBtTh98dlHJ5aozpJXwtOo7T81gILYR7UkiOxEKYp5grC6GF0ELY7soWQmNMJ/hadByn57EQWgj3pJAciYUwTzFXFkILoYWw3ZUthMaYTvC16DhOz2MhtBDuSSE5EgthnmKuLIQWQgthuytbCI0xneBr0XGcnsdCaCHck0JyJBbCPMVcWQgthBbCdle2EBpjOsHXouM4/c7tOVjlF8vc6xXJ8ccLyFlnCSmdk1M0NFeRHHSQwKgSpHRlDm0K2z+G2bxZgOQ0ujKWlwi2IRzKEA4/XEAuvljAerJRQ8iUKUJKt+Y0unJRWYIhYIfS4tyoofimHHKIkNKanKKhBYoGy1Ns4IklMhbQsBoYAtbipSTkYGNJnIt20UnoE0aEIWDhPn26gO09oQQ4F9tdlnuHBvuINjIxEJ+LXqF0KCPCQ4luoBR9Rjdw5bgUvUKfcS56BdCruM+YK7g0OonSGB1RuTw1xvQSvhYdx+l3LIS1hoBYCIOGEAuhhdBCuIehjAgPJbqBUvQZ3cCV41L0Cn3GuegVQK/iPlsIjZkY8LXoOE6/YyGsNQTEQhg0hFgILYQWwj0MZUR4KNENlKLP6AauHJeiV+gzzkWvAHoV99lCaMzEgK9Fx3H6HQthrSEgFsKgIcRCaCG0EO5hKCPCQ4luoBR9Rjdw5bgUvUKfcS56BdCruM8WQmMmBnwtOo7T71gIaw0BsRAGDSEWQguhhXAPQxkRHkp0A6XoM7qBK8el6BX6jHPRK4BexX22EBozMeBr0XGcfueNnJ/8JOU0WuYWyofMVl7PadQQ1sBFokV/o4aKiNWceGLKaXTl2NPSZyIaNdRpri7OueCClNOoIeToo4WUrs7pcOUDUw6eSQRP3cEHC8VvB2JxvJY+kyzEA3xYyilGtF7RxEtkrMWx+EYpFt/xoj++FM4FcDxcCiOKK4NYNuJOxq4FMFdoCHcBxO3CPeKGMFcADeHKKC1PD0A3cI9QGf6P3w7AP/xDBH5owG8H+Bsq/q0EP1LEQ8B49SeMcnlqjOklfC1qfhaGtR3HGY5YCGsbKmIhrG0IsRBaCGsrAwthDhqyEFoIjRmP8LWooQJqWNtxnOGIhbC2oSIWwtqGEAuhhbC2MrAQ5qAhC6GF0JjxCF+LGiqghrUdxxmOWAhrGypiIaxtCLEQWghrKwMLYQ4ashBaCI0Zj/C1qKECalg7zODgYOt/Wx+qz9XXLus4zriPhbC2oSIWwtqGEAuhhbC2MrAQ5qAhC6GF0JjxCF+LGiqghrXDtHU/fC7r5EXVcccZ3zkrB5s0HnqokNIGBZmpaHSVD0MoFu4bFQlMrMjzwkDKKRbuUUPItdcK2EizuPImBYnmCpKDNVJxU6KGCjFDRJB27kw5xYhezcGGtEW+k7N+fco57jghpR0Kcq0iuekmIaWpObNnp5yU3lckWF4it94qYCfYYq4+UjS4o3iwsI8oQC91mUuwni4r5MQNYS2O1TZK40sB6FMpYzk4F6VQApSik2gXpaX25Fx3XcQNNwgoxV6vsXphJjFA2BTUC9248UYB56Ib8TMZjzduN6ac6u5nA6W4oTrecnlqjOklfC1qqIAa1g4Do2sreN3UcZxxHwthbUOIhdBCaCHcg4UwAEaEUgthQDnV3c8GSnFDLYTGjCb4WtRQATWsHaa0u9Y/AObHLYSOkyyEQUOIhdBCaCHcg4UwAEaEUgthQDnV3c8GSnFDLYTGjCb4WtRQATWsHSawu6rIQug4yUIYNIRYCC2EFsI9WAgDYEQotRAGlFPd/WygFDfUQmjMaIKvRQ0VUMPaRbr8179ACOuKHGccx0JY2xBiIbQQWgj3YCEMgBGh1EIYUE5197OBUtxQC6Exowm+FjVUQA1rF2lrffmRXPlaR7LyPUdQx3EmdOAeRxwhFIk3aXxHkcydKxTLayRu6DrlJzm48kknCZ0ie3KiDJJz2mkC8uKLQjpAmDdPwKUwhFtuEZAtWwQ0lI4S0BBGhF5RCMFpSlqcgyu/8IKAQL3Q0HPPCejVpEnCpk0C8tFHAkeU5ipX5uCmbN4sMFi4lxsz5kB5cb9hF/AlKB+WyCiFA2DR/73vCVj0x3YB9YJMxjtnos+YOggDpg6Tg9J4vKXY5OAuYHJuvllA5dtuE/BLA2432sWIcOW4obhXaAiVMc+4C/iBA3ewtPoc3AVcCs9VfPdxLh5vrVwuT40xvYSvRcdxRnMshBoLoYXQQmghtBBaCI0xQ4KvRcdxRnMshBoLoYXQQmghtBBaCI0xQ4KvRcdxRnMshBoLoYXQQmghtBBaCI0xQ4KvRcdxRnMshBoLoYXQQmghtBBaCI0xQ4KvRcdxeh0uc6fnYKnWaJn74INC0VAUCOG2bUKRtwU2pLuM6namGNEbbwhMhytLMIRqi6o9G1XpJqtYFKEhbKP69tsCd2Q9XNGwoSbBiNIpCreNRRrMVUo3CfFcdYiYJ37RSGmlgmwWBpKA8NkIN+BFZSyCY5vCuhZbKeJSmKxGq22UYrUN5wGlx+bEC3f0GQOMZwPnTp8uQDVjxb39duGOOwToE8Qsnjr0GdMO48VfwbFLQ70Azo0vhVL8svC1rwm4Rxg+Bghgno3c8ktfEv76r4W/+ivhL/5COPvsnHJ5aozpJXxLOo7T63AhayG0ELYPtc1CmIfPhoWwHguhhbDCQmiMsRA6Tv/DhayF0ELYPtQ2C2EePhsWwnoshBbCCguhMcZC6Dj9DxeyFkILYftQ2yyEefhsWAjrsRBaCCsshMYYC6Hj9D9cyFoILYTtQ22zEObhs2EhrMdCaCGssBAaYyyEjjPqMpR17ZiofJCwbp3ATFKQRu2y8k+VuHLoLTqiDt3AiI5X4sppvqJhNzSHKHEnD1PiyuxkWJkTO3yVh9KNP/sz4ayzBKxrzztP+O//PQLn/vmfC2go7kZ87rnnChde2ADsG3vxxQJGdMEFAhzgb/9W+Lu/E9DQZZcJf//3AipPnSpceqmAPuNcdON//A8Bl/riFwWcC9Du3/yNcM45AowIt6xR5c9/XlC54oP02c8Kn/uccOaZAi6FhtBJVAZ/+ZcC/uDoH41yeWqM6SV8S2qWh2Ht4cgnP9w7zoROo0XwWKxsIcyxEA5X5aF0IzYxC6GFsA4LYYCF0JixA9+SGiqghrWHIxZCZ8Kn0SJ4LFa2EOZYCIer8lC6EZuYhdBCWIeFMMBCaMzYgW9JDRVQw9rDEQuhM+HTaBE8FitbCHMshMNVeSjdiE3MQmghrMNCGGAhNGbswLekhgqoYe0wLdPbs5vD3iNVUC2okB/PDzrOeEmjRfBYrGwhzLEQDlfloXQjNjELoYWwDgthgIXQmLED35IaKqCGtcNA4fKv+Nz2YN3n1gfHGUfhuvZBRcNV/jpF02h5zcqhihyI/S2vVTQc4A5Fc7CCqAKdfLLAaLsrVwqMDv/554ViH1Fs4LkpZ9KklFNU/pFwVMr56CPh2GMF7OCIDTzhCym9mLN4ccpJaYHyujCQhHSOIiM66qiUkyYL2JH1wAMFXBkjwk6KKc0WPpUEvQvoxumnCx1kA6KCyl/+cgTMBDYFM4FsQK6woyOuDDAEqBeGcPnlAh6sadMEDBC9QkMojSvDxNDJr3xFQCnuES51xRUC9hG99VbhvvuERYuEhQuFJUuEpUuFhx8WHnpIwDbQqPzIIwK6MW+eMGuWcM89wt13C/feKyxYIGCA+Jvi0UeFjxeCOY89JqAUc6XDL5enxphesnvpU5s95lcT1g4Deav7Wn6IjzvOuAt9yUJoIbQQWggthBZCC6ExZqTYvfSpzR7zqwlrhykFD0G16kN83HHGXehLFkILoYXQQmghtBBaCI0xI8XupU9t9phfTVg7TJ3gIXXiV3fcccZd6EsWQguhhdBCaCG0EFoIjTEjxe6lT232mF9NWLtILm+l4LUtzT9087n1wXHGUehLFkILoYXQQmghtBBaCI0xI8XupU9t9phfTVi7SFvly49UyQ/GFfLj+UHHGbOZokCudJm7a5ewZo0AnUDllHYqHyorlWU511yTclLaIlDbzsuhEalNrVolQGN27hSOPlq4/nohpYuV2xXxlpkzU87ttwsp/V5Rbdsrii0uukjYJ067OeIIIX1aSf+ibMvZti3lHH+8gJncsEEorHWJoJ1M6ZocSh3kSu3xxBNTTkpzhd0Cto80TZmZw0clvSN8/Hd+BrQlpXdzbrkl5WBbzUMOEbjqjYkX7gAOgDUxePxx4Qc/ENaujUDlJ56IwF8cYPVq4ZlnBJSC2AEeeCAC8wy5wk84+IsDw3/ySQETG18Kc4V5xmw8+6zw9NMCeoW5QruwKTxI6DNuWaOHAVfG8xzfBdxf+CHmGZVXrBB0+OXy1BjTS5LjOH3OFAvhPiyEFkILoYXwEyyEORZCY8xIkhzH6XOmWAj3YSG0EFoILYSfYCHMsRAaY0aS5DhOnzPFQrgPC6GF0EJoIfwEC2GOhdAYM5Ikx3H6nCkWwn1YCC2EFkIL4SdYCHMshMaYkSQ5jtPfvPOOAG/BEgKSs2xZyknptZxrr005uDI2eIQRYb0xMCBwpZ5+mnPTTSkHjlco0E05WPZgU0rIFTYpxJ6cUBHoMStDVFTb6MOHKboF65w5KSelCxTZNva661JOSpcqV+TAh1PanIM9C198UUDp1q0CNilEZQ4/nZnTqbIElVO6TMgN9nCx7k9AtBRbkr73ngCJxRC4FtelKtfiWDHjXPyZjK8Mb8GKGWtxtDt/vnDXXQJ2zsRDiSvHvcIQ0EmA4WPq4A9QkfvvFzCi224T8LfMzTcL+OsMpd/9rjBjhvCNbwj4a/SGGwT88IBS/PG+8UYhHgKujBHFV/7e94Q77xS+/30Bz8Yddwjf+Y6AKwNs0Iq7D01VyuWpMaaX8A3rOE6PYyG0EFoILYQWQguhhdAY0y/4hnUcp8exEFoILYQWQguhhdBCaIzpF3zDOo7T41gILYQWQguhhdBCaCE0xvQLvmEdx+lxLIQWQguhhdBCaCG0EBpj+gXfsI7j9DonKAcq6Tc569ennDRJOUI5Ukmzc159NeXALtKhKQcLyCILlVk5hXpJsIA87jiB23uOvxwUol7aAZrnvCa8rWxVViuvK8ibijwMxVa3YIcSd2O7gkuhk5sU+WGlg5lgpf7tbwvf+paAlTo0BldeuFDArpvQdFz5m98UsOUuzASrfLgWgC9deaVwxhnCf/7Pwh/+oXDKKcKpp0b8yZ8If/zHwh/9kTBlinDaacKf/qlw7rkC9pydNk346leFyy+P+NKXhKuuEqDluL9waYg3/H/u3Abce6+AUhjg3XcLeBhQOnt2BMyzCeXy1Jge8/aTv5zI8E2O6C7fxNmbwcH201F33HGyWAgthHWU1hdgIbQQWggthHMthMbsD6UjTSj4JkcCnQmK9mZQw+JRHPS8FVbKUldad9xxslgILYR1lNYXYCG0EFoILYRzLYTG7A+lI00o+CZHWjrT9t8GuzAd6NBYtKMu+1xXre6442SxEFoI6yitL8BCaCG0EFoI51oIjdkfSkeaUPBNjoyYEFb/7FbWCQ7mx8s6+Ye8cnlufhDHkbK07Yn5QRxvW6c66DgWQgthPaX1BVgILYQWQgvhXAuhMftD6UgTCr7JkZa5DBZURWFgPtXXXIrwufUh/9xN5fxrXgdf29ZBfQRFdV/rLlh3sPrsOKlYqmIRXC6ac7YpWOVjTVyenvOGslHZouDKWJpjWQ9QGaBX6MaNytQQtItLzYtGCr8AAEcMSURBVFJQeqWC8a5Xpilod46ChmBi1yjTFejxYuV9ZY3ysjJbWRFyuwL/x/DxAG9QMMBlyisKgsqyp25Kq5SnlfcUfcywCMZqNV4T33OPgFIsvlEZ+z1i49AYuCVKsd8jDAG9wrnYCnbJEgESixFBgbCRJszkkUcEGBF2WMbGx+DxxwWc+8QTAra4xKXWrROeeUYotscUUPmppwT0au1aAZfCuQCVn35awBBQGjeEIeBcVI4bAvg5U0vL5akxppfwfYu0tGWwoCoK0zKfKvnxrJZYU3687cG6yh2PBwfb1mklKEpdNFp+aPvVmeDZZCG0EFoILYQUsxgLoYWwAuoVe1rckIXQmAkJ37dIS1sGC6qiMLn24DNSFuVHqs/516bHcRBhjb0pi9qeiGrlcZxVHXecZCG0EFoILYQWQguhgHMBKkO9Yk+LG7IQGjMh4fsWaWnLYEFVFAbaU33tRofqKu/38Y4H2ya+WsdGyw+OU2aThdBCaCG0EFLMYiyEFsIKqFfsaXFDFkJjJiR83yKBxQRFexNoUl7U1praVsbn1ofgeF1RfjA/Xqa8Wv657QXxuTyYH3ecZCG0EFoILYQWQguhgHMBKkO9Yk+LG7IQGjMh4fsWGQzplFJ7IEjQpPx424N1x1ufq4N5ndaR4FwcR8rS/KyqtDpYFVXH889lBcf5OHcqcDxduabrFZRuVqATuxSY2AsKlvUA9rhWuVSBpsKXcGUEA8RcrVGgMe8oWxS0i4bgPCiNL4WsUlAZt3uNsk7ZoKxW5iszFMgkHgYo7iwFtxudxE1Zq+DczQq0DUKIS6HPyEzlXQXD1248+qiATUcXLBBgj9gLFMAtUQp7hOMtWiRAn9BnlMLisE0wlA/2iM0wsd0ldCIGJoZurFwpYESxxcEuYl+C8kHM0A1MHWYDAhxvHIpewQBj1YyddtUqYflyAWoNW37yyQhUBrGHA3QS6LSXy1NjTC/hG9VxnJ4H6+ltFsIsGCDmao2F0EK4NxZCC6GFcDcWQmNMQ/hGdRyn58F6epuFMAsGiLlaYyG0EO6NhdBCaCHcjYXQGNMQvlEdx+l5sJ7eZiHMggFirtZYCC2Ee2MhtBBaCHdjITTGNIRvVMdxeh6sp7dZCLNggJirNRZCC+HeWAgthBbC3VgIjTEN4RvVcZyeZ6vSWtxXYBGMymsVbIYZN/SBEgcK9KEC5dsZgsBa31KWKBuVbSEYIMQMvZqtYOdMKC66gYmFl6JXGCCyRkHlOcpSBTaFXmFL0u0KKkPb0I14CLjUrBA8sVtC016p7FTmKG8qGJFqauwADz0kYLWNtfiyZQIqg6FIXVwZoDJUE+BcXbhzCOgVRgQazRWujJsCicV+rdA27KoKD8cWrPB/WDpKsUErtlHFleNL4THDbq7z5kWgXYDJQSkmB51ENwAeFdxfPHX4ZUHvb7k8Ncb0Er7JHcfpebDqXW0hzLAQ5syxEFoI9xBXBqhcSqCF0EJoITRmAsM3ueM4PQ9WvasthBkWwpw5FkIL4R7iygCVSwm0EFoILYTGTGD4Jnccp+fBqne1hTDDQpgzx0JoIdxDXBmgcimBFkILoYXQmAkM3+SO4/Q8WPWuthBmWAhz5lgILYR7iCsDVC4l0EJoIbQQGjOB4ZvccZyeZ74C94ARwS5eUG5X4sBb3lWw2n5HwUodvZqrXKm8p2xU0C6W9RggShF0EhqDhjCTuDIGuFqJ78KaEFgcLrVJiecKpctCXlZw7g4FNxSluxRcCncBlTF8zPN2RS2O9hh7ePjEYpkL90BprAQA3oJSrMXjylipY3mNpXnpDDkQFRgCGopnA50sbSQH7ULb4Gnllq05d98tlGPMiXWxrJ+DyhgCwGzEU4dbBj2GD8OWoV4Q70a7yMbgYYC14s9C+eNCDp5YnatyeWqM6SVcQGkG02AAazuOs1+xEOagXQuhhdBCuBsLoYXQQmiMGRm4gNIE1hcUVRkc7FxnWNKzhhxnJGIhzEG7FkILoYVwNxZCC6GF0BgzMnABpWlZX9t/G7QQOs5wxUKYg3YthBZCC+FuLIQWQguhMWZk4AJKM1xCOJgl/5rXzFMdR1F+EEWtlGdVRxxn1MZCmIN2LYQWQgvhbiyEFkILoTFmZOACSjOMQlgezD/n8tb0c+tr9RlfUeQ4ozBY1gMsZBcqWJqjMi4Ft4Tz4FIAFodLbVHQ7lsKOglwqQ8UrPI3K3OUdxV0420FKTuWA1FZq8Bb3lUeVOBacdAuejUn3GYTldcqqIyGNil4NnBl3CMMEA29oCDY6xW9wt1HuzOVK5R5AtbxWATHnoYFNErjc7FExgIamzQ+/HAEVupwD3gLBAnLelgcBAlDwKXQEIwX52KeAWYDggSbevxx4YknhFWrBJSuWSNAvTDP6CQk9rbbBEwdzo1nA08OGgK4C7GHoyE8hADzjJnE1D31lPDMMxFPP51TLk+NMb2Er19NL4WwOjiU422/Os4oD/QJYLVtIbQQVqBXcyyEFkILoYWQd9BCaIzpBF+/mjEqhK0jreC444zCQJ8AVtsWQgthBXo1x0JoIbQQWgh5By2ExphO8PWrGbtCWCUocpxREugTwGrbQmghrECv5lgILYQWQgsh76CF0BjTCb5+NYH1BUVV2vpb28+Du9Poc+tDx68ocpxRGOgTwGrbQmghrECv5lgILYQWQgsh76CF0BjTCb5+NeW/DeLfCeO09be2n1uyV6WqgKL8YFZlX53giOOM2sxQsGK+U4FsIBsULKCnKlcr8Sp/jrJJeUd5S1mnrFEwIl2ppwUKrgzzxKUwhFcUdGO1co2ChqYrUJFlyi5lhfIjBb3CtK9VMLHYzXWDMkvBeLE16BYFldFJPKKYZ7Q7jJmqYAiLFQjh68IPfiA8+aSARTBKdV2b1q0TULp2rYD1NLoBsNpGabw0R59RGvcK4FLoBkpjf4jPjcGlIBsYERqKbxkmZ/XqCPQK7a5fL8QNoVcoxRDiAaJX6DOuHIOJRSnaxU3BiIAOoVyeGmN6ibxd+xebmzORYyG0EFoI9yNTLYT7wKVQGX1GadwrgEuhGyi1EFoI69AhlMtTY0wvkbdr/2IhdCZyLIQWQgvhfmSqhXAfuBQqo88ojXsFcCl0A6UWQgthHTqEcnlqjOkl8nbtXyyEzkSOhdBCaCHcj0y1EO4Dl0Jl9Bmlca8ALoVuoNRCaCGsQ4dQLk+NMb1E3q6O4/QjFkILoYVwPzLVQrgPXAqV0WeUxr0CuBS6gVILoYWwDh1CuTw1xvQSebs6jtOPYD29U3lbgQNgmYsdHVcq6xWYCXa/hFyhFJ1E6asKKm9X4A9QPtjUy8rtCvr8nrJGWapgct5VPlDQyW0K7hFuCiZnh4Kbgm5g58w5CiovUDDtuGWYyfkK7uBsBTdlvYKG4NL4+QMuDRGF8WLq8AMHlB6zobcsFhUsvrEmjg0QYGkOX4qX1yiNl+YgHkIjwmU9/QGl6FXsD42Gj3NxU9CN2JeeCHcoRa9iIcRsxAMEjaYOQyivFoCGULpypYDxxr3C1GFi9VLl8tQY00u4MnUcp+exEFoILYQWQguhXrnR8HGuhbB70BBKLYTGTAy4MnUcp+exEFoILYQWQguhXrnR8HGuhbB70BBKLYTGTAy4MnUcp+exEFoILYQWQguhXrnR8HGuhbB70BBKLYTGTAy4MnUcp+exEFoILYQWQguhXrnR8HGuhbB70BBKLYTGTAy4MnUcp+eBts1TNipYfMeBPzQC/oD1NPocW9w74R6kmxXoxNYQ6MSdygvKQkX3maQuYutXDGGLMlXZqaBXGC98Cb1apsB5oJr4deA1ZaMyR1mrQL0QdAM3FEPAkwMPf1q5SsHkgFeVWUo8fH1ySu3JwYoZpVgEY4kcCwNKh0KjpflKXeU//rjw6KMRy5cLS5YIS5cKy5YJaAgagyGA+C4AnNvIxMq5zYm7AefBbDz0kPDww8KKFQJuGbpRdjsgnslGv2igMoaPK5ezl6PnlstTY0wv4XteM/3g3waw9pDj/zdCZ2JmpYXQQmghtBAOCbSLXlkILYR1M2khNMZ0IYQ8tDdBUZVBDYuLdFOn++Bqw3txxxnGrLQQWggthBbCIYF20SsLoYWwbiYthMaY7oSw7b8NdimEwdcyHSs0yvBezXFGListhBZCC6GFcEigXfTKQmghrJtJC6Expn9CWP2zIQ7GFfLjbQ9Wx9seCepXFcrjdQcdZ7iy0kJoIbQQWgiHBNpFryyEFsK6mbQQGmP6JIS5XOFz24N1n/Gh++MdP7e+4gM+O85wZbuyTlmmYMX8rgKric0EvKJ8qGC1DbCs36R8oMA90GfIBnqFfUQ3K5g6bNAKX4JNbVcWK/MU7AWKc+EtUBEMoV/ZoqxUMIRtyg5lq/KygpuC2ZivwMPxqKAyAvN8R0GfdUTxihmr3rhyvIDGufF6GpVx5XjRD9eCqEDMYvfApdAN9DkeAkA3oKnoM7qBhjCT2N4TPPusEO8FGt/9eK7i+4tnA6Xx/UW78bkx8RDiuwDQSUwsZkPbLZenxphewjeqZuhCmCc/ntVqo14dKwSpqzxcxx1n2AOdwAJ6mYXQQjgC2WIhtBBaCC2EvBSGEN8FgE5iYjEb2m65PDXG9BK+UTVDF8K6zwjqVB/i41X0Yu0r7/fx1uf8yo4zvIFOYAG9zEJoIRyBbLEQWggthBZCXgpDiO8CQCcxsZgNbbdcnhpjegnfqJphFML8a51Z1VWoO972YF3l/T7e8aDjDDHQCSygl1kILYQjkC0WQguhhdBCyEthCPFdAOgkJhazoe2Wy1NjTC/hG1UTWF9QVKVOsQZ3p+3xskLwGR/qKuBrxwvia34cdRxnWAKdwAJ6mYXQQjgC2WIhtBBaCC2EvBSGEN8FgE5iYjEb2m65PDXG9BK+UTXlvw3i3wnjlPoEE8t9LC+tq5AfrztYFaFmfkpVhIPVZ3wtKzvOMAZbZWLl+rqCxfdbyvsKrAbMUbDaxjr+dmWJgsq4Ms5draxVZilbFWjMRgXnoiGUQnJ+o6AyBCm+MiZnmQLjje/vzhBMHcClMFcYPu4ghoCgMi61SoGWx79o4CHEpXCP0C4mB8NHn98XFi0SZs0Svv994d57hfvuE7B1JDaWREM495ZbhJtuikDlm28Wvvc94Z57BGwNuny58NhjAnYZvf9+Yf58Yc6ciAULBEwOtiSFXcDTACoD+BI0Bl4a7/aJS0FyAC61cKGA5yoGU4f9SyF1UM3YeOO5Kqc6B+0CyCRmUu9CuTw1xvQSvucdx+l5LIQ5kKutyhYLoYXQQmghJKUEBpJjIQymzkJozISE73nHcXoeC2EO5GqrssVCaCG0EFoISSmBgeRYCIOpsxAaMyHhe95xnJ7HQpgDudqqbLEQWggthBZCUkpgIDkWwmDqLITGTEj4nnccp+exEOZArrYqWyyEFkILoYWQlBIYSI6FMJg6C6ExExK+5x3H6XngadCnVxXYI/KKskDBWnypgspvhEBjtisIrPUDBQt3LOtxLgzhzhA4ACwODeHK14S8p+CW4crIBkXNJK1XdiiYjXnKKwrME48Zgj6/pmwL7XG7gplcq0Dq0O6HCp4NdAOquUvBXOEPzjJhuRrRI48IWHw/+KAAq8GlsAjGihlr8XilDnBlaBucB44HYETYhRKVMRsYL7oBx4MhoJMYPswEw0cnYWLxTJbqkoPZwDyDlbozKojHi4nFuWgIbhlbK0A30BDuEZ5n+P+8eQJ+0UDp4sUCnhx9VMrlqTGml3BR4DhOz2MhtBBWWAgthDUaA3BlC6GFsA4LoTGmE1wUOI7T81gILYQVFkILYY3GAFzZQmghrMNCaIzpBBcFjuP0PBZCC2GFhdBCWKMxAFe2EFoI67AQGmM6wUWB4zg9j4XQQlhhIbQQ1mgMwJUthBbCOiyExphOcFHgOE7PA+WDbLyrYF0LycECeosCb9mowD1gF7MUrLYRlGKAaGiVgkBE4Q/bQzBABJODqUNDKIV7LFHKnnQP+rxawbOBTuKWwZfw5OAeoXS+ggHiXEwO7i86iVKcCzAb7yorlTuVVeFzpVeOF+5wj3h5jV1GsZ7GAhpgD9J4PQ0lwLIelbGtKBoC2AwTO5TOni3cdZeADVrvvlvAudhIEw3h3LlzBVzqjjsEXBkbw6IhlOJc3EGAqcM842HADYU8l5oX3F80hL1eH3hAwA6ljZ4rPN5xr+DS+HOES+m55fLUGNNL+JJkfhsy/BkcHOShnmRwd3jUcXoSC2GwcLcQ5lgIc1ZaCGuX5hZCC6GF0BjTNXxJMoH1BUV70rKsKixuly6rNUrHa3as4DgjGgthsHC3EOZYCHNWWghrl+YWQguhhdAY0zV8STIt62v7b4NdCWHwtW26qdM0Ha/ZsYLjjGgshMHC3UKYYyHMWWkhrF2aWwgthBZCY0zX8CXJDKcQ4sjefzj8JG0P4nj1GV/rTskr5B9Qs/oaHHGcEY2FMFi4WwhzLIQ5Ky2EtUtzC6GF0EJojOkaviSZkRLCUsA6fm59wNe6+nnqKrS9eDcXdJzhDRbfWATDPbDKn67MUmBis5W3FOxCOUfBpVYoTyswk/UKVuoLFOxfulZBlilbFWwNik5iI01ku4LxxpuOQlS2KPHULVQwOQ8qVyjTFNwyXGquMpTgif1AwWzALd9RliqYjdXKlcp8BQ8D7oL2GQv3eOPQlbquhR/CHuP9LbGRJkqxc2a86ya6gX0my700A9AQrox24+09160TNmwQnnkmAt2AXaAb8bSjk88+K6AUfY4HiE5iCDgXncSIMM9Qr1jbcLtxZXSyvOMBmMnyNuXgXGyjij9lavjl8tQY00v4YmdGUAhH9Hjbg3WV8+N1dRxn5IKFrC5VLYQWQguhhfApC6GF0EJojBkp+GJnRlAIEVTA16bH2x6sq5wfr6vjOCMXLGR1qWohtBBaCC2ET1kILYQWQmPMSMEXOzOCQqgle1LnY02Ptz1YV9lC6PQ3WMjqUtVCaCG0EFoIn7IQWggthMaYkYIvdiawvqBoTwK5Gtydsig/js+tD+Xxtp/ztL1I3fFuLug4wxssZHWpaiG0EFoILYRPWQgthBZCY8xIwRc7U/7bIP6dMEpLqKoEpW0P5sfzotbn8nhVilQHURocD67mOMOeHcomBUvktxScC42BP0xVdikzFKzU3+gTbyrblFkKHADBuaiM0rgh1QkGrgXFxR3ELYNNwVpRGZODEcUN7VRQOsESb3epK1duSoktHLFwx5oYi34YAvwBy3rs6IiNJW++WfiHfxBuuEG48UYBO4Vi71NsOoq5wraiAFcG2EcU0w5w5fgezZsnxIYfyyTAzwEPPihgRNdcI1x5pfDVrwrTpwtXXCHg3PhS4GtfE2bMaAC68ZWvCJdfLqChq64Svv51QUvL5akxQ2fjPU+YLuFrcYzHCueMxUDqNlkIMyyEFsKRj4XQQmghbIuF0IxlSu0xdfC1OAaT/0OfhdAZi4HUbbIQZlgILYQjHwuhhdBC2BYLoRnLlNpj6uBrcWzG/4WnM6YDqdtkIcywEFoIRz4WQguhhbAtFkIzlim1x9TB16LjOD0PpG6ThTDDQmghHPlYCC2EFsK2WAjNWKbUHlMHX4uO4zhOw2C3zzGRBn0+4gghpQ+Vdcr7wuQkpDXCQIo4WLjzTqH46WSLcGgS6PCXClOnNgCr7W98Q/jmN4WrrxawRG6tquuYNk1AN7AWL0/PiRfuKAVxN+KGoBNf/rLwpS8Jf/M3wjnnCGefLXz+80JcikuBuPJf/MVIgXYxV9ddJ8B4H3lEePRRAZq6aJGAnzDg/w88IKAhsHix8PjjAuQZpfoDR7k8NWZUsWrG3TmzzrtqnPHJy95xHMcZQhrI1ahJgz5bCAULYU7ckIUwAO1aCI0ZxVgIHcdxnDgN5GrUpEGfLYSChTAnbshCGIB2LYTGjGIshI7jOE6cBnI1atKgzxZCwUKYEzdkIQxAuxZCY0YxFkLHcRwnTgO5GjVp0GcLoWAhzIkbshAGoF0LoTGjGAuh4zgjne3CgUnAXqAHJeE44YADhA45ROC5emUurz+tTFIOUwYENqSlHL429MYbQjpAmSywIbULDhCXOkZBZQTj1cqTJgnpRAXtpjmCVl67VuCl0I1JAmfjdAU5XhlQ0lpFwvFygGG0z5z2AYEN4cmJ7yBKdW3KBTS2jsQGngB+iGX9TTcJ3/uecNttwuzZArpx++3CHXcIKI3BlWHe2LETwoA9SLGfJ3ZkxaUgOdi/NN7OFH3GpqPxTrDQGOjT/fcLuAvYzfXaa4VbbxUwhHiece4ttwh4NuLxxhOLUvQKDxJKcRcwhHhE+HFk5syccnlqjOkl+jJmTvjx/wtg7XEU/18aOr2MhTADw9eGLIQWwgo2hCcnvoMotRDmYFlvIbQQVlgIjRmn6MuYKSVwP4Sw/H+NL3WrqoOaedoeb3swT8cKbdPxrI4VHKf7WAgzMHxtyEJoIaxgQ3hy4juIUgthDpb1FkILYYWF0Jhxir6MmVICmwphLk7V59KmcKSs0DpYVmtbM0/HCm3T8ayOFRyn+1gIMzB8bchCaCGsYEN4cuI7iFILYQ6W9RZCC2GFhdCYcYq+jJlSAhsJYZ01lcdL08u/VgfLavmR1tf8YHmk7iCO50XlwfJI3UHH6SYWwgwMXxuyEFoIK9gQnpz4DqLUQpiDZb2F0EJYYSE0ZpyiL2OmlMD+CmH1v22/1n1ufYi/Nj297njbr44T53wBC2gwRaAhQAnCNTHPnRStxaETOHfGDIErdXQDGgO0Mi91uoIrM+otaCgtESarT+LKAJV12jFXHMKAovMM8ca5u3YJBx4osJNweOTgkPxJmMRTWRlPHaK/O6TPKKcpByiYnAEFA5ys4FLIpxV4GhayWIsDVIYwoDLsAmJ2ww0RME9dT3N30299S4Cm4k8s9j7FpdDuXXcJMAToBCrDLjAbEBU4Dy6FXl1/vYAbinmGPsEAYa3xEEq7zsHdRyfxYwHc8jvfEfAw4DG75ZaIeDbwAOOG4i5g+LjdpRPm4FJ6u8vlqTGml/AtqSklcOSEMA9KW2kdr0rbfq1Sdxypq1Z3Vl19JC51HOR8C6GFcA8WwhxMzoBiIbQQWggthMaY4YBvSU0pgSMnhG0/58llrBSz1sE8qFClm2r5127qt46U1Rynm5xvIbQQ7sFCmIPJGVAshBZCC6GF0BgzHPAtqSklsAdCWH7Fwdy4yg9IfOW60/f7eNuvjhPnfAuhhXAPFsIcTM6AYiG0EFoILYTGmOGAb0lNKYGNhDCpGtXZVHmkrNDx4ODutD1eHcTX/JTgc+tDcBxf82qO003OtxBaCPdgIczB5AwoFkILoYXQQmiMGQ74ltSUEthUCNNeQSqVKT+el1Z1Oh7BQVwTB9seaXu8Kg3qd1nNcboIFrJhIBtY13EP0nRxzjHHpJyUrlai0D2wUscGjzCESbCLBYoG53JEKwUoASpDCQaUTyu8C+8KsBqgAzzuOIHDL+0r5ygFGRDYkE7djTcKHD5MDHfwOAF3f8kSgdN+uIAnlk+O9vn55wU+DJhJjKi6lS20G+lYBU8Olqpz5gjwFqyYAVbMANuKYpWPlfottwhYXkOf0Gf0CueiFANEn3Fl+NL8+RHoJMClsBlm3CuUAlwZQ7hDNQZuCU8rNS8Hl4I9ojI6GY8X52L4eGJxQ3Hut78tXHONgGcSl0JDmFj0GZ3E5IRXLpenxphekhzH6XMmWwiz4FyOyEK4DzakU2chtBDuw0KYc4eF0EJojBGS4zh9zmQLYRacyxFZCPfBhnTqLIQWwn1YCHPusBBaCI0xQnIcp8+ZbCHMgnM5IgvhPtiQTp2F0EK4Dwthzh0WQguhMUZIjuP0OZMthFlwLkdkIdwHG9KpsxBaCPdhIcy5w0JoITTGCMlxnD5nQEGwdeQBCpb1n1EgG9CYYwXaBS6FdTxW2ygFWNbjXKzjEQrhpcoqBaXblTnKK8o2ZarygfK0skHZoWxW3lS2hjyvnKlgvDqEATxXm5QZCvK6ghENpaG3FEzOihw+k+wGzp2qfPIjSMZGRacOS3OAZW686oXz4FIwE6y2cSkAqUPpLbcI2FgSm1LiUth188EHheXLhaVLBZQ+9JCweLHwwAMCKj/8sPD448LTTwvr1wvPPitgH+QnnxRWrBBWrhQee0xYtSpi2TIBP5bEcwUefVTApRYsEBYtEjDPOBegMq4c74uLygsXCnhyHnlEwP1VyuWpMf3ltxMsrXe/4zj9ywDW05pjLIQWQguhhdBCaCG0EBrTOyhM4z2td7/jOP3LANbTmmMshBZCC6GF0EJoIbQQGtM7KEzjPa13v+M4/csA1tOaYyyEFkILoYXQQmghtBAa0zsoTOM9rXe/4zj9ywDW05pjLIQWQguhhdBCaCG0EBrTOyhM4z2td7/jOKMmk7Hd5ZocrCe5zKVcvSqw9ELlBWWXUtnObo5IOa++KsBbtm9POTh35kzhueeErVuFXbsEXCql3ym/EU5PQro+Z/XqlJPSRQrE7EVlnnJlztSpKQcievTRKSels3O4uWv6SPlJDvYO3LlT4G8H6UZFjPfkk1MONoadPj3lpPRhDu5gSm/n4Fxsk7tli5DSNAWO934OtjBM6ac5fHLwe8cTTwiwi3/8R2HzZgHPKHj5ZeHXvxZQ+aWXBFTG7MTnApxbVsjBAFGKdtFJ8M//LDTqBhr61a8EXArEUwfQLkoxG5s2CfFcgbhXqIwrx9OOyiiNK//iF8IvfylgvLgLcbtxn3X4XJw6jtPbpDCDv/q/AaztOM4wxEJoIbQQ7sZCGCygO5wLcG5ZIQcDRCnaRSeBhTAn7hUq48rxtKMySuPKFkLHcSyEjjPqYiG0EFoId2MhDBbQHc4FOLeskIMBohTtopPAQpgT9wqVceV42lEZpXFlC6HjOL0SwsHBQXxwHKcmFkILoYVwNxbCYAHd4VyAc8sKORggStEuOgkshDlxr1AZV46nHZVRGle2EDqO01shtA06ThexEFoILYS7sRAGC+gO5wKcW1bIwQBRinbRSWAhzIl7hcq4cjztqIzSuLKF0HGckRfCwXZhJceZ0PmUogtorNSnTUs5sMczzhAKA9yRg4X7jTcK6SSh8JYLci64IOW89pqQ0tocNpR+L0xJOVddJWDT0YMPFlJal3PCCSkHCvTeeymn2P3yspzTT085v/udkNLCHGxDiN0QDzlEwHLrgw+EY44RIGbY4Q/dSKemnMMOEzixZyj6M0RKc3OwCKR4U57nKOLh2AszpVmK5LrrhLPOErD94YcfCu++K2AmuQgGjVQEs4MbXEpCDi6FUiyv49U2TAygctxnzAYqx91AKQYYz3M5PzmoHJ9bTldOXDm+KfG0ozKmDpSjCMCV0clyjN2PCKUYICqD+MnZuFHQc7k4dRynt8ELFyklsKkQpvC/Fy0VsazjOOM9FkILoYXQQvhSsRZHabmyz4nNxEIYEFeOb0o87aiMqQPlKAJwZXSyHGP3I0IpBojKIH5yLISOM4qDFy5SSuAwCiE8EGboOBMmFkILoYXQQvhSsRZHabmyz4nNxEIYEFeOb0o87aiMqQPlKAJwZXSyHGP3I0IpBojKIH5yLISOM4qDFy5SSmAjIaw0Lw8rOc5Ej4XQQmghtBC+VKzFUVqu7HNiM7EQBsSV45sSTzsqY+pAOYoAXBmdLMfY/YhQigGiMoifHAuh44zi4IWLlBLYSAhbaUmgVdBxamIhtBBaCC2ELxVrcZSWK/uc2EwshAFx5fimxNOOypg6UI4iAFdGJ8sxdj8ilGKAqAziJ8dC6DijOHjhIqUENhXCygMthI7TPosXC6+/LmABndJVOTt2pJzzzxdSOj8HO5SefbaAFfOVVwpvvCFgtX3kkQI87f33BTgtlvXYKhN6/JnPpJx0mLBtm3DeecKGDUJKMwTVp5NOEtLJIdxldFrOlCkp5803hZRWKtfkwOKwbSz2IMU94laox6ecww8XTjtNeOEFgV56oKI7o2LbWAwfO9Bi8ZnSFmWJ8PFLJAfWqjflo4+E4patEOLVNtbTKI0X0CCujNJyKZ8T718K0GeoSKMRwXniPseXQmV0AzelNKhgCJgc9LmczJx46lCKAcbjLbudg3MxfLgWwE6hAEMAcbvl/OTEkxM3pHBx6jhOb7N7Qeo4Tv9iIbQQWghbWAiFcv2dYyEMhmAhtBA6jtMkuxekjuP0LxZCC6GFsIWFUCjX3zkWwmAIFkILoeM4TbJ7Qeo4Tv9iIbQQWghbWAiFcv2dYyEMhmAhtBA6jtMkuxekjuP0LxZCC6GFsIWFUCjX3zkWwmAIFkILoeM4TbJ7Qeo4Tj8zM+fii1MOXAuL4GuvTTlYT//Lv6ScY48VuAknNzuVLUlT2pmD1chbbwn6/zQziM1OMcCjjhKef17Akgnn/uhHQkobld8pl+ZcdFHKQUMpXSRwcq7IOeiglIPKmI1zz005mFhslZnSuQr283wn55RTUk46QMBCLqU3ct5+O+Vwz9WTdNfZE5T0U2WdouJ9eMo59VThgAOElM4Sjk1Cek6RPuOHlbVrBTxmXMjGOhGbGFa6sYoUy2IBS3OUlqvzAHQSpXEnURprDMC5mLqynzm4VGkyOTgX40XlRhOLSzWaSbSLqYtnsmwrJ67caAjx8HHL0Ge8CV58UcAPS+GmslycOo7T2yTHcfodC6GF0EJoISxo5C0x6CRK406iFH9Uym7n4FxMXdnPHFyqlMAcnIvxonKjicWlGs0k2sXUxTNZtpUTV240hHj4uGXos4XQccZLkuM4/Y6F0EJoIbQQFjTylhh0EqVxJ1GKPyplt3NwLqau7GcOLlVKYA7OxXhRudHE4lKNZhLtYurimSzbyokrNxpCPHzcMvTZQug44yXJcZx+x0JoIbQQWggLGnlLDDqJ0riTKMUflbLbOTgXU1f2MweXKiUwB+divKjcaGJxqUYziXYxdfFMlm3lxJUbDSEePm4Z+mwhdJzxkuQ4Tr9jIbQQWggthAWNvCUGnURp3EmU4o9K2e0cnIupK/uZg0uVEpiDczFeVG40sbhUo5lEu5i6eCbLtnLiyo2GEA8ftwx9thA6znhJchynv8Er9YorhBUrBFgN/AE7WP7ud0JKVysioiefnHK4zabunJnSrcrLwqDuBnmq8J3vCNjONKUNOTNmpJyUXlOk8tSpKQerkenThaefFlK6OAeKm9IFCrrxHeVpQYd/4okCbUorY22GvUBTuj1n8uSUU/RKt6s9NAnMeuXtHMwzSosBvp6DfXHxq8SSJcL69QJ2VcXuptiv9YMPUs4ttwh4GLhExqoXpaWNBIt+rLZBfC7+aoDGoDJK0Wc8SWgXDZWDCjrZqFdoCJXLtrpvF7IBcG6j8cbPBi6FXuHcWL3A//k/QlkhB31GQ+gGwKVQCsVFaTxXZT/r4eLUcZzeRtcAzNtP/jKAtR3H2Y9gRWEhtBBaCC2EnWUDlWMVwZOEdtFQOaigk416hYZQuWyr+3ZLCbQQVqAbAJdCqYXQcSZGdA3AlBI4vEKY/4dU+cGsChOXOs7YC1YUFkILoYXQQthZNlA5VhE8SWgXDZWDCjrZqFdoCJXLtrpvt5RAC2EFugFwKZRaCB1nYkTXAEwpgfsnhJXFBeLXto7jjP9gRWEhtBBaCC2EnWUDlWMVwZOEdtFQOaigk416hYZQuWyr+3ZLCbQQVqAbAJdCqYXQcSZGdA3AlBI4FCGsM0AcrFIdqY5XX3G8OlgV5SmPZ3Udp9/BisJCaCG0EFoIO8sGKscqgicJ7aKhclBBJxv1Cg2hctlW9+2WEmghrEA3AC6FUguh40yM6BqAKSWwqRBmXrYvVZHW3RMcz09pfe3+OD63PuCz4/Q97wofr3Qz7rxTeOUV4Y03hNNPF444Qti1SzjmGGHxYiEdr6QlypwcrPJXrRJgnu++m3JSWqu8pWxXHsw5/viU89xzQkofCackQbfZRK8+9SkBW2W+qHvppWMFaPmhhwowk23bhPQZJZ2fc8EFKQd7kBbD/4Iid2HKlJSDyryDhwjvvScsXSqcf76QjhRWrxZggMUAz8nB1H30kYBfUlK6U+DOqKsE+AOW9aUk5DRaMUMnUBmXwgaPIG437gaA1eBc9BlzhUthoY9LFRoQUfpzQDnkHHQyljpcuZyu7sGV0W6jxwyVGw0QlBfPwZUbPWblTez6hnJx6jhOb5PClBLYVAiTqpqWiC7mB7MqtV+HeNxxRk8shBZCC6GFsFh8lxJoIayjHHIOOokRWQhzcOVGj1l5E7u+oVycOo7T26QwpQQOrxDmqatW97Xp8dbnVrJyx+l/LIQWQguhhbBYfJcSaCGsoxxyDjqJEVkIc3DlRo9ZeRO7vqFcnDqO09ukMKUENhLCSsDysNLeVEWoU/e16fGOBx2nX7EQWggthBbCYvFdSqCFsI5yyDnoJEZkIczBlRs9ZuVN7PqGcnHqOE5vk8KUEthICFtp2VfpYHXmVnccX4PjdZ9bH/DZcfoeC6GF0EJoISwW36UEWgjrKIecg05iRBbCHFy50WNW3sSubygXp47j9DYpTCmBTYWwrY9VaQlbrm35weprVZR/rTve+pynPF4dcZzRkBtzbr895aC02P5xqnByEo4SsHHo9dcL3BpUHSCdIbz2moDdIGGt2JNz3ryUU+x9+pwiO3bCANMkgXKlpj1/fspJaZ1ygfJ75ZKcM89MOYcfLnDqjhbef1+AL3GAaq3FtrFwaam8bFnKgcWl9I4wOQmqT/RD/ISRLlTeFPQHjp/8RMA+sTRt3YL1ww9TDh9+/ZECW5Leeqtw7LECJQeL73JJnYNVL5bXxcI3Il5Al03nxMt6DDAWFVwq7hXAuSAeEaY9PjduN24IlVEKMJO4Miw9fhjiSzUqbQS6EQ8/7nNcGaXxnyM9l4tTx3F6mzTeY/1zRn8shBZCC6GF0EJoIey6tBHoRjz8uM9xZZTGf470XC5OHcfpbdJ4TCWB/vdAZ0zEQmghtBBaCC2EFsKuSxuBbsTDj/scV0Zp/OdIz+Xi1HGc3iaN0/i/DnXGUCyEFkILoYXQQmgh7Lq0EehGPPy4z3FllMZ/jvRcLk4dx+ltkuM4/Y6F0EJoIbQQWggthF2XNgLdiIcf9zmujNL4z5Gey8Wp4zi9TXIcp9/5Qs6rr6YcbO9J90g/Ud5S3s4pfOmiHGxJmtKligrSqSlnxgwBm0Oed17KwT6Tp5wiHHmkgCEU7nGx8nwOZnL6dCGlWTnQ40svFbD5J136MAG2jBGdfLJQbCuKbFZE+Qoj2qhsVXRfTUYbGkhCel1Br7Yo6ORqZaqCO4gh4CHc3oRdCtrdJjQSJJTCARqB1TYcIFaCRioSDwHEs4FeoV2Ulk3noCEMEJXLCQkagoqgIfzw8Pzzwg9/KDzxhPDgg8KiRcIjjwgPPyygdOFC4YEHBJyLH3gAtuvFzr+4VNwrnAtQ+aGHBJSik8uXB3Bx6jhOb5Mcx+l3LIQWQgthCwzBQphhIQxAZQuhhdBxnCZJjuP0OxZCC6GFsAWGYCHMsBAGoLKF0ELoOE6TJMdx+h0LoYXQQtgCQ7AQZlgIA1DZQmghdBynSZLjOP2OhdBCaCFsgSFYCDMshAGobCG0EDqO0yTJcZx+p8Fq+4ILUs6ppwpDy6sKltdx0Oc4O5SXlTiQHERENKX5SpgDFOYVZZaCOzhNgdVA2uEtyE7h4CQ4w5UVKwRsm4utUTdsEB59VLj3XuG664RLLhGuuEK48koBv2FcfrmAylddJXz96wIqx+eiFJf62tcEVMaPQ7jyzJnCN74h3HST8P3vCzCxlSuFxx4TULpK98mFPmEDYojZ3XcLN94ofPe7Au7v5z4n/Jf/IvzBHwj/7t8Jhx4qjPdwceo4Tm/DP5Oajfc8EcDajuPsVyyEFkILYV9jIbQQWgj7Gi5OHcfpbfhnUlNK4DAKYfn/Gp8fqf6f5ctqjjPOYiG0EFoI+xoLoYXQQtjXcHHqOE5vwz+TmlIC908IK6mD8lWfcQRFZU3HGU+xEFoILYR9jYXQQmgh7Gu4OHUcp7fhn0lNKYFDEcKOmlcnhI4zvmMhtBBaCPsaC6GF0ELY13Bx6jhOb8M/k5pSApsK4Z7/6FNTFWldC6HjOBMtsYhOUg4cPpCywggxOtt1xln+1b8SjjpKOOEEYcoU4bOfFf74jwVsi/yHfyj8h/8gfOpTDTj2WKGskDOUhsDoaJeLU8dxehv+LaopJbCpEKZ6zSutLz+S+SOrOY7jjJdYCHtD3K4zzmIh7J7R0S4Xp47j9Db8W1RTSmDPhDBP3XHHcZwxHgthb4jbdcZZLITdMzra5eLUcZzehn+LakoJbCSE+b/yVclLs7rtj7RSd9xxHGeMx0LYG+J2nXEWC2H3jI52uTh1HKe34d+imlICGwlhKy2dK6Wu9MPqKyqX5zqO44yLWAh7Q9yuM85iIeye0dEuF6eO4/Q2/FtUU0pgUyGsc7zqYJ66ovy444y7lIvX7mmkEwcpCEobVUbQLjoZ97lnQSePUtKbCnY3VTiiJcKhSUB47kYFwdavcSexmyuyTcG5urtp+lBBu6gcl8Z5Q8FsoM9vKWgo3iZXr4ylKla9J54owB8gDH/6pwLs4r/9NwHbBEM2/uiPhJNPFtCNP/kTAQ2dfrrw6U8LkycLRx8tHHRQxIEHCjCxf//vBYzoi18UbrhBwLaiy5cL2BgWu4wuWyZg61fsXwruv1946CEBe5Bih1KAcxcvFlCKdufOFcp+5syeLaCT8+YJmI177hEwhEWLBOypi/1aH35YuO8+AVdesCCHi1PHcXobviQdx+l1Ss3rHuqExkIYxEJoIbQQWghLLIQ5FkLHmRjhS9JxnF6n1LzuoU5oLIRBLIQWQguhhbDEQphjIXSciRG+JB3H6XVKzese6oTGQhjEQmghtBBaCEsshDkWQseZGOFL0nGcXqfUvO6hTmgshEEshBZCC6GFsMRCmGMhdJyJEb4kHcfpeV5QsDTHmhil05U4WEBjxQxQ+W0lVhGAK29WMMCYBUrYjaOTkF5X4A+zFXQSI4pLceVGpZuUXQp8Cfdoi6I5TEEOUTqUXiKclASk/Akg53BlCMk3Itu9Fxnm+XrlXQHuoUvVtHChgHU8ltc4F6t8VC4VIgfr+DlzhLvvFu66S7jjDuHmm4VbbxVQGXYBYQDoBs6Ft0ByMBtg1izh9tuF224TbrpJuO46AaqJ2Yj7jDsIyUEpJufb3xb+/u+FCy4QvvpV4ZprhGuvFVB6xRXC3/2d8Gd/Jpx5pnD22cLf/q0wdarw5S8L3/2ugIcBXgpLf/zxHC5OHcfpbfhOdRyn53nBQtg1FkILYftYCC2EFkILoeM4+xe+Ux3H6XlesBB2jYXQQtg+FkILoYXQQug4zv6F71THcXqeFyyEXWMhtBC2j4XQQmghtBA6jrN/4TvVcZye5wULYddYCC2E7WMhtBBaCC2EjuPsX/hOdRyn39mmxIHk7FD0UgNJoHvMUCAbUKAVOW++mXLWrxdOOEFIaWUO1sDpYGHSJAGlsLjjj0856QThuOOElOYrkpkzhZTeUb6Qc+edKYe7jDbLVEXCuUq3K3BLZKoClx6V+bQyhGAfzZReFLBlJXZWhIkB+AOEEJfCPpPYpDFmzRrhqaeE554Tfv5zYetW4de/bsDmzcJLLwlbtgg498c/FlavFlQJeBeeeEL42c+ETZsENIR5hph95SvCwIDw138tXH21gPt7yy0CvPTKKwUY4F/9lfDnfy6ccYbwb/+tMIzBlY86SsA+sX/wBwL+Vv2P/1HA9rz/9b8Kn/98DhenjjNR87M+hX8zaFbNuDuAtR3HGY5YCC2EFRLOlYWw61gILYQWwvaxEDqjPinto+PXOINpsKLd11TBM3uVT9ws60fHr3Hic3/78aD3wr8ZNKUEDrsQ6n/js+9gVkWO5B/anus4Yz0WQgthhYRzZSHsOhZCC6GFsH0shM6oT2yAFsIg8bm9F8JS5+KvpeCVRXXnOs5Yj4XQQlgh4VxZCLuOhdBCaCFsHwuhM+oTG6CFMEh8br+EsHuFK4tKDwzqOM6YjoXQQlgh4VxZCLuOhdBCaCFsHwuhM+oTG6CFMEh8bi+FcLBdqiKtuy9lUXlWUMdxxlaWKshNCjJXOUfZKRygGzzSH6YKrAx9ekvZomi73KEUILHVIOEQ6DyojBFdqqDyKyFod42C4NyNDeBNeUNBfdwUzMbVyi5lmoKHEJdCQ/hVAj8lXKugMkaErUH1yRlIQtqu6FaobOgd4S//UjjrLOGccwTs2YhNGqETX/yi8KUvCdOmCV9RUcGOjtijcupUAVfGuejGZZcJl1wioDJKL71UwKXQDfQZ56I0HiBGhKnDuaiMduPZQLsoBfFs5HezBJ286ioBbonfHbDVbb5758fAh1EZe+piE138hIFzH35YiBvCpeDSukErl7GO4/Q22SqlTUoJbCqEqV7h8q8dXbEsCuo4ztjKUgthFvQqTjgEegsqWwgthHuxEFoIK9AuSkE8G/ndLEEnJ7wQ5v9Y4a/+Ogq//uztjHH3NVultEkpgSMkhDjSTVFQx3HGVpZaCLOgV3HCIdBbUNlCaCHci4XQQliBdlEK4tnI72YJOmkhDNfi/uqvff8a2NQ4+JqtUtqklMBGQvjJP/kVyUuzunKkm6KgjuOMrSy1EGZBr+KEQ6C3oLKF0EK4FwuhhbAC7aIUxLOR380SdNJCGK7F/dVf+/41sKlx8DVbpbRJKYGNhLCVlqe1tTUczGUP6lh6YN25jjPmstRCmAW9ihMOgd6CyhZCC+FeLIQWwgq0i1IQz0Z+N0vQSQthuBb3V3/t+9fApsbB12yV0ialBDYVwjp/q9KSvVz5yuN5UfW5roLjjLnoQvaIJKQPlLMUrJj1UkcnYQALaDiP44ylHHigwOf5oCQcrqAy9m/FyvWBB4T77hPmzo1A5dtuE77xDeH884X/9J+EiZaDDhL+zb/Zf/71vxacINhl9MwzhcsvF/A8488RVHPlSkG3yd29OHXGUpY7/UjK9wkdZhzH6XMshI7TOBbCcR4LYV/SRyGs/7eLkf3q7Fc+lpPpB/+2IpcWZ+RSWNww4jhOn2MhdJzGsRCO81gI+xILodNdllsI+5HC4oYRx3H6HAuh4zSOhXCcx0LYl1gIne6y3ELYjxQWN4w4jtPnWAgdp3EshOM8FsK+xELodJflFsJ+pLC4YcRxnD5nujI/4vgkDMDxNiqblKkK9opcq+BS2BvzLWV1zqGHphws3I8+WsD+lii9/nph+nTh5JMFOkB6NedHP0o5S5cKKd0pTErCAcohCicWYANPKd20KeUU516mYBPOixS9KegkjOhghTdUwB3EMu+664R0jHDNNUJK5+WsWZNyUrog5+qrUw6280xpmyJzdd55KQcT+9prKSf9+MfCCy8IKF2/Xnj8cQHbMGKy4hXzkiXCo48K2EkS7a5eLaxbJ/zTPwk//7nwq18JL70k/PrXwubNDcCVAZ7+n/1MwJ/YJ54QMJOYdkzOD38oPPusEN9f9RbeBbT72GMCFAi9WrVK+MEPBPTqpz8VfvlLAbfsn/9Z2LpV2LJFiG83zkVpXBlXfvFFASPi2tQY02Mcx+lzLIQWQguhhdBCaCG0EBpj+oXjOH2OhdBCaCG0EFoILYQWQmNMv3Acp8+xEFoILYQWQguhhdBCaIzpF47j9DkWQguhhdBCaCG0EFoIjTH9wnGc/uZkJb2nvK5sFAYghFOVa5QVyjRhchJwKYgo1Is7o6Ibi4WWU+3lwQcFLIkhG7/7nYBtVKdOFYq/6zbkYM0/aZKQ0oMC9mvVIaRDhcmThULqNitvKTsVnIvKYryFH+LngO2CGi8cvnCtHcq5wmlJ0J8wTj015XAm00pF+nzccSnnhBOEOXOE4s/RzJxt21IORCw984wAuVq+vAFY9McO8OSTAtqFTuDcuBT6BKt57jkBfxh+8QsB/gDli3UCNFKRWBehbbiD+KUBdwFS99BDAjaVxd9QjZQP9xfKF1fGEJ5+WoDi/uQnAu7v888LuL8bNwqYdtxu3CMYIIi9FFfm39fGmB4TZdZ5VwWw9jBlcLBDrzpWcJwxFS5kLYQWQgvhJ1gII+WLSy2EFkILoTGmAVFKCRxGIRzU5MezWm3SsYLjjKlwIWshtBBaCD/BQhgpX1xqIbQQWgiNMQ2IUkrg/glhpXCB+LWt0zYdKzjOmAoXshZCC6GF8BMshJHyxaUWQguhhdAY04AopQQORQjrDBBfIY1V2h7MjzvO2AwXshZCC6GF8BMshJHyxaUWQguhhdAY04AopQQ2FULIWytVEWqWHxp9dpwxmYsuEs46S0ifEbDfI5b12O0zpe8IA7BHXfTzUrKsf//9lINexRtavvyywModcqGyJeekk1IOBsg+w/FOTzkHHyycdpqQ0k9zNmxIOSnNyaEQwpZ1ctKBypHC3LkCz6VbnqVMFzjt8wSW3p6Dp66YHHlU+NsBftFgKfZN1V7BHtnJ/R8ClR5rU2yG+fOfC9gdEU8D1vHYKRQ6gVU+gD/gXGgM7AJ+iE7CpqCLkEkAncDUQfmgBPi7AKU4F+CmoBRuCcX9X/9LgHhD+e6/X4hvGVwLYoaNUmGtmFj0CjcFdxBXRin2mMWl0BCeHIBOYjZwKTyx+LMAicXOt1ybGmN6TJRSApsK4cfJ5Q3H8+TH8aHL444zJmMhDGMhtBBaCC2EFkK9gxZCY8wwE6WUwOEVwrZfyw9dHnecMRkLYRgLoYXQQmghtBDqHbQQGmOGmSilBDYSwk/+4a9IXprVbeN7HSu0/eo4YywWwjAWQguhhdBCaCHUO2ghNMYMM1FKCWwkhK20hK3Utjqvyz80+uw4YzIWwjAWQguhhdBCaCHUO2ghNMYMM1FKCWwqhLm5ackel6uSH29bp+3B/LjjjMlggYHne/bslFOsxUUJpuo2m1gVHHKIsMdAKtKynDPOSDkpPZ8zY0bKwd6nWIvCarCJ3c6dAlfq2M40LVCm5px5ZsopNuF8RYA/HKzoxqHFjp0wMelGsReotvvxZOaoTKZ0raI2hUupLx1+uIANPD/8MOXgueJOsDqEo49OOdix88QThZRuzTniiJSTjhKOPFJI6UblzRzsMYs/ONgml6X4ZeGEJED5YBdwnqGUQmManRvv2AngWrhyvIEn9qiEPUIJsOhvpEBwD+zYCZYuFR55RIDFoRRDwN+M6CRKoTFxKWay0f3FHYQAA9zBX/5SwKOCdgHOLSvkoJMYQjze+FJcmxpjeozjOH2NhdBCaCG0EHY+10JoIaywEBpjhhnHcfoaC6GF0EJoIex8roXQQlhhITTGDDOO4/Q1FkILoYXQQtj5XAuhhbDCQmiMGWYcx+lrLIQWQguhhbDzuRZCC2GFhdAYM8w4jtPXnHuuwJ1CdQH9ibnlqBJQcmAmR+h2l8djv0fdlBKSMyUJAwp8iaXY/RLZqUzLeeONlANbLnTiCznLlqWc7duF3/9eSOlSAeNNM3OwBqZsHJNyWPlUZa/A7CH9SLlOeT9nYCDlpHSBAOc5TcBMFuK9VcCjgseM8qxPXZqh4HarWmsnU7pIkeGzIfxJOVJR0z722JTDpSqWyBs3Cj/fLY0V2FgSwoBtGJcsERYuFO67T1i0SMC2ovAlPGdPPilgF8of/1jAvqkYL9xy61YBpfAWzCSI/QHCAMlBNwCujF7FoJPoFRrCvqkoxbRjE078cobSZ58VsFHqP/6jAKeFtMcuDUvHk4NO4vGOH6T4dmOuuDY1xvQYx3H6GguhhdBCaCG0EPIuWAgthMaY3uE4Tl9jIbQQWggthBZC3gULoYXQGNM7HMfpayyEFkILoYXQQsi7YCG0EBpjeofjOH2NhdBCaCG0EFoIeRcshBZCY0zvcBynv9FF8EknCTCilK5WtuUcdVTKOf10odh3cU7OccelnJSeVnYJWLirThxzjFBsaCk7ZxZW8xvlXGVqDtY5VIK0UaAAfyKcGbKhJfX4QPVwWs08QcX70EOFAw8UrrpKwN/Pr78upDRbWaKcmfPCCyknpfk5O3aknJTOzsGWpFdfLeDJKXYZjeT5zTeFlK5SJNgb8uMDOcWOu2/l8Hk+INy9FmtTSM5QzASVY+dBKYC3YHkNcGX0CsqHhTsawoaWWPT/7/8tYJfRp54SILEw3gceEGDLMVAgSA7+7vunfxKef174xS+EeNobleKGlnctIH4IYy+Nn8n4yigF6CQeJDwbsNa1awWuTY0xPSbKbwd/G8DajuPsTyyEFkILoYVwi4XQQlhP/BBaCI0xQyVKYH1BURX+R0ntDrai5+2pxkN7D/LkmivjxPJ4XZ3yII7kXx1nyLEQWggthBbCLRZCC2E98UNoITTGDJUoLetr+2+DXQph91+RtqWtg22LUnG8+trN8eBz3emOM0yxEFoILYQWwi0WQgthPfFDaCE0xgyVKH0UwlRUaCtyefa7flkBRXmFsrLjDC0WQguhhdBCuMVCaCGsJ34ILYTGmKESxUJoIXRGPGefLWCpCseDEWHvRO7ZmC5RXlG2C1gi646dME/sbnrJJcKuXUL6tDBpkoBdGNPhwpQpArdgZV7MgYhi6QIx413gPK8SVPmKqcO5QHyYV8Y8Y7xqNZMnC4cfLlx2mZDSZcqOnPfeSznFc4VpV1s+QbczxV6gdGmdDWxYqj80FA8/skCRvPiicPLJAnag5doUGgPJ+eEPBcjG8uUCfrRAKXQZvoRtJ7FlJawGA4bFxYt+CHDsw7gynAdArn7+cwFDwEaauCmYnP/f3h3jyFGEUQDuiJDQIeIInMEnIOAAG1jIB7AQkQ/gBDmycOZbmMQXQPIdCBxyACIQzKqoen91udezsJ7R9+nJ6v6rZna9a0v1WNR+/XpIlMmXL4fUAtknHv365s2Q+C7Edz86T/wG378fEl/JdU+Lr2R82aNbxmtjNT7JeH5pPDg0Hisam+O/M8Unue7S8VnFap5NReR/zsr5hbBXV2MSYkO7jbfdm//7ynGpH8ZFU5fqBdyPrCJjuyhn4psxCmFPIVQIbymECqFCqBCKyOGsnF8Ip9d7k2paw/ZeeGTPNnvPunm6dLqum+EsWUXGdlHOxDdjFMKeQqgQ3lIIFUKFUCEUkcNZucdC+NHbqUUxqw6+f33PunO6pBDyn8gqMraLcia+GaMQ9hRChfCWQqgQKoQKoYgczsqi9S2WmnVDO9is/vxHTPrbZm/bkfmR69Pt3keHT5RVZGwX5Ux8M0Yh7CmECuEthVAhVAgVQhE5nJX6s8H4OeFa7U6LrrWndrDTpNfm/bZ+Ujf3q+02NpyGcRsTONc33wzZtt+HfLX1iQeHbtsPY74d83zI2LW2r8dkYYhm8n2fm5utT5SrbftuyNgeo9XE5g8ftj7Png159WrI8+dDti+ie4zVK1d/HfO0z5MnW5/yG/x5yNh4o8Y8ejTk6dMhWQi/3IZsv/SJTrttP475aUyIR5L+0ScO29Fx4tGvjx9vfa5BnKfXJ/X1WXz9oMUodVE24tmYcVKPKhLPbIxvYfxVefFiSLSp+DTWfTieyRmlLjbHJxkFOMrG27dD4nGm0XjjL0MkvinrrHvaOYl3jo8bf5DWiSYWf5CuQX8wFbm4AJxHIVQIFcIHFif1ONavz/GxqhAqhC0K4R3UE7bIBQXgPAqhQqgQPrA4qcexfn2Oj1WFUCFsUQjvoJ6wRS4o3I/2v2s2uQOulUKoECqEDyxO6nGsX5/jY1UhVAhbFMI7qCdskQsKwHkUQoVQIXxgcVKPY/36HB+rCqFC2KIQ3kE9YYtcUAAAAAAAAAAAAAAAAAAAAAAAAAAAAD5r7357t0juBgAA4GosWt9iqZn+W/MxPBlfd2s6j2F9+XRSL3rTYZvHUp00bT8AAMDFO7W+6c8GDxbC47dVbVmfPNm76E2HW5mvbwEAAK7EZ14I23Ud1sn0ojcdbvvzk/UqAADApXrwQth+rbd1qb+uk+lFbzrc9ucn61UAAIBLdX4h7NXVmITThrYtbuvS3nB60ZsO2zyW2rAtxQQAAOAanF8Ip9d7k9A29E2sXizmp+u6NP3Q02G193EBAACuyj0Wwo/eVn1/q13uNOzFhnZdl/o9zXRYxbaDrwIAALgwi9a3WGrW3emjVWq6Ya/ULeZ1af3Oob7h4hYAAOBK1J8Nxs8J12pZ6id1NUw3nIbHl/6ug6UH7r08TJe6V9wuxQTu5C9WscT87J7xdgAAAABJRU5ErkJggg==3e:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==3f:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==40:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==41:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==42:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==43:T5bc,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEyLCJTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLDAzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGwiLDAyLCJTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5Db3JlXDMxZmFlMzI5MGZhZDMwYzMxYzk4NjUxNDYyZDIyNzI0XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIlN5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbS5YbWxcMTVhZjE2ZDM3M2NmMDUyOGNiNzRmYzczZDM2NWZkYmZcU3lzdGVtLlhtbC5uaS5kbGwiLDAyLCJBY2Nlc3NpYmlsaXR5LCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsMA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"6508440d23e336997707082c","environment_id":160,"environment_description":"Windows 10 64 bit","size":147152,"type":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","type_short":["peexe","assembly","executable"],"type_short_id":".NET exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"DownloadHelperTray.exe","md5":"72248e24644abcdc01b3effe0f876b1a","sha1":"4c6ed0d58bfb8fa6cfa8f8c82e9472935a2b9b3f","sha256":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","sha512":"4ee30f267c5e12acc82a0025f48e5f63d2cedce4cf890e532d969b3ba9a0ea3d2dd7d46c464a33910214e53f5a1feaafde4d893d85a7483dd76f17d89423557f","ssdeep":"3072:oukXia3t2YekT0qFULgkvEQkOwwY7XP04:oX3thAVD4","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","entrypoint":"0x422b4e","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["LOCAL_SYMS_STRIPPED","32BIT_MACHINE","EXECUTABLE_IMAGE","LARGE_ADDRESS_AWARE","LINE_NUMS_STRIPPED"],"dll_characteristics":["NO_SEH","TERMINAL_SERVER_AWARE","DYNAMIC_BASE","NX_COMPAT","HIGH_ENTROPY_VA"],"major_os_version":"4","minor_os_version":"0","av_detect":4,"vx_family":"SmileMotion","url_analysis":false,"analysis_start_time":"2023-09-18T12:35:25+00:00","threat_score":51,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[{"owner":"CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE","issuer":"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3","serial_number":"481b6a07a9424c1eaafef3cdf10f","md5":"3C:59:FF:68:9C:16:9A:B9:30:4B:F0:87:06:42:9B:CE","sha1":"87:A6:3D:9A:DB:62:7D:77:78:36:15:3C:68:0A:3D:FC:F2:7D:E9:0C","valid_from":"2016-06-15T00:00:00+00:00","valid_until":"2024-06-15T00:00:00+00:00"},{"owner":"CN=Hexagon AI Ltd., O=Hexagon AI Ltd., L=Victoria, ST=Gozo Region, C=MT, OID.1.3.6.1.4.1.311.60.2.1.3=MT, SERIALNUMBER=C95306, OID.2.5.4.15=Private Organization","issuer":"CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE","serial_number":"3468b8e920eb67f7272b6d59","md5":"69:6E:6E:BA:E5:F1:D4:3D:2D:34:77:C1:88:24:1E:CD","sha1":"1F:23:01:43:E3:D8:32:A2:59:D2:94:75:BE:AC:49:88:E5:ED:3E:F3","valid_from":"2020-07-15T09:23:04+00:00","valid_until":"2023-07-16T09:23:04+00:00"}],"is_certificates_valid":true,"certificates_validation_message":null,"domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":1,"total_signatures":120,"extracted_files":[{"name":"DownloadHelperTray.exe.log","file_path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log","file_size":1119,"md5":"e42227926beece353c1a72e36f28d312","sha1":"b2eaa362954f95ed3976e0c82000f17ff1207aec","sha256":"7b1d6976fd8a53d7225b2bda4422e6869a6ff87afa2d348ff7c8f4d5e85c08f1","sha512":"378783b170841d9ee77edccc01718ccb670db447a32f6a65992188d12022556d711525495195157925ad820347a2793ee8a73bd2b7a4ed4967e0c4e92cc62d5b","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"DownloadHelperTray.exe (PID: 2096)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6508440d23e336997707082c/download/dropped-file?key=9dd30cc9ea90b2ee659f9e6680e17b4cc242d21a21a2abf7e6f14802a9ea0e0aaf3e5a4bf4a24b4d525dddb9a044365b27501d74564f698868fd7c220be72eac9d1d9b85c6b8936898cf8357fde0c26adc3246da31","submit_link":"/bff/report/6508440d23e336997707082c/submit/dropped-file?key=9dd30cc9ea90b2ee659f9e6680e17b4cc242d21a21a2abf7e6f14802a9ea0e0aaf3e5a4bf4a24b4d525dddb9a044365b27501d74564f698868fd7c220be72eac9d1d9b85c6b8936898cf8357fde0c26adc3246da31","has_overview":true,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00002096","parentuid":null,"name":"DownloadHelperTray.exe","normalized_path":"C:\\DownloadHelperTray.exe","command_line":null,"sha256":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","av_label":"SmileMotion","av_matched":3,"av_total":63,"pid":"2096","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"3/63"}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Loads the RPC (Remote Procedure Call) module DLL","Loads the .NET runtime environment"],"parent":null},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to execute Windows APIs","Contains ability to load modules (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to start a process (Dotnet)","Found Native API in Dotnet file","Dotnet source code contains suspicious native API"],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a reference to a WMI query string known to be used for VM detection"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to execute WMI queries (Dotnet)","Contains ability to execute a WMI query"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found named pipe like strings"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to enable or disable privileges in the specified access token","Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found PE header in memory"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Timestamp in PE header is very old or in the future"],"informative_identifiers_count":12,"informative_identifiers":["Loads the Bcrypt module DLL","Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Contains ability to decrypt data using RSA (Dotnet String)","Contains ability to encrypt data using RSA (Dotnet String)","Matched Compiler/Packer signature (DIE)","Contains ability to perform crypto operations","Contains ability to load manifest resource from assembly (Dotnet)","Dotnet file contains encryption/decryption functions","Contains ability to perform CryptoStream operations (Dotnet)","Contains ability to perform symmetric encryption (Dotnet)","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to enable or disable privileges in the specified access token","Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads the CLR Loader DLL","Can loads assembly that contains the code that is currently executing [Dotnet]","Contains ability to generate intermediate language instructions (Dotnet)"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to show a graphical window (API string)","Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to decode base64 data","Contains ability to perform AES decryption (Dotnet String)","Contains ability to decode string content at runtime (Dotnet)","Contains ability to load content into memory (Dotnet)","Contains ability to perform symmetric decryption (Dotnet)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["The input sample is signed with a certificate","The input sample is signed with a valid certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Drops files inside appdata directory"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["PE file has unusual entropy sections"],"informative_identifiers_count":2,"informative_identifiers":["Matched Compiler/Packer signature","Dotnet file contains function to dynamically call methods at runtime"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found PE header in memory"],"parent":null},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found virtual disk drive like strings"],"parent":null},{"tactic":"Credential Access","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Touches files","Tries to access non-existent files (executable)","Tries to access non-existent files (non-executable)","Reads files","Calls an API's typically used for searching a directory for a files","References Windows filepaths for DLLs (possible dropped files)"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found system commands related strings"],"informative_identifiers_count":11,"informative_identifiers":["Calls an API typically used to retrieve OS information","Calls an API typically used to get system version information","Calls an API typically used to get product type","Calls an API typically used to retrieve information about the current system","Contains ability to read software policies","Reads information about supported languages","Reads the cryptographic machine GUID","Read system defined device setup information from registry","Reads the active computer name","Contains ability to gather system information (Dotnet)","References to WMI query strings used for information discovery"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to enumerate processes/modules/threads"],"informative_identifiers_count":4,"informative_identifiers":["Calls an API typically used for taking snapshot of the specified processes","Calls an API typically used to determine if process is running under WOW64","Contains ability to enumerate process and/or its information (API string)","Contains ability to gather process details (Dotnet)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to get active windows title","Contains ability to retrieve open application windows (API string)"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Opens registry keys","Queries registry keys","Dotnet code contains ability to query registry","Contains registry location strings","Found registry key string for installed applications"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/techniques/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to create an instance of a named pipe"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Writes log files","Calls an API typically used to create a directory","Contains ability to create directories (API string)"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to upload data with network (Dotnet)"],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Making HTTPS connections using secure TLS/SSL version","Possibly tries to communicate over SSL connection (HTTPS)"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains reference to Windows HTTP services (API string)","Contains ability to provide interface for network protocols (Dotnet)","Contains ability to communicate with network (Dotnet)","Found user-agent related strings"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform encryption/decryption using RSA algorithm","Contains ability to perform asymmetric crypto operations"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found potential IP address in binary/memory"],"informative_identifiers_count":2,"informative_identifiers":["Found potential URL in binary/memory","Found potential URLs in memory dumps"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform symmetric crypto operations"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform encryption (API string)","Contains reference to cryptographic keys"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-171","type":0,"relevance":1,"name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"DownloadHelperTray\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"DownloadHelperTray\"","Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-107","type":0,"relevance":1,"name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"DownloadHelperTray\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"DownloadHelperTray\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"DownloadHelperTray\"","Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"DownloadHelperTray\"","Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-173","type":0,"relevance":1,"name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")","Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","description_v2":["Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$25","description_v2":["Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"DownloadHelperTray\")","Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"DownloadHelperTray\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"DownloadHelperTray\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"DownloadHelperTray\")","Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; File: \"DownloadHelperTray\")","Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; File: \"DownloadHelperTray\")","Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; File: \"DownloadHelperTray\")","Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"DownloadHelperTray\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"DownloadHelperTray\")","Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"DownloadHelperTray\")","Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"DownloadHelperTray\")","Found reference to \"(GlobalSign Timestamping CA - SHA384 - G40\" (Indicator: \"SHA384\"; File: \"DownloadHelperTray\")","Found reference to \"(GlobalSign Timestamping CA - SHA384 - G4\" (Indicator: \"SHA384\"; File: \"DownloadHelperTray\")","Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"DownloadHelperTray\")","Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"DownloadHelperTray\")","Found reference to \"ystem.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"ystem.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to \"System.Security.Cryptography.RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to \"System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"RSACng\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"(GlobalSign Timestamping CA - SHA384 - G40\" (Indicator: \"SHA384\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"(GlobalSign Timestamping CA - SHA384 - G4\" (Indicator: \"SHA384\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"ystem.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"ystem.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"Aes\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"RSACng\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-134","type":0,"relevance":1,"name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-135","type":0,"relevance":1,"name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System\" and MemberReference \"GetMethod\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"memorydump-8","type":20,"relevance":1,"name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002096.00000000.69552.00010000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002096.00000001.71472.00010000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002096.00000002.73391.00010000.00000002.mdmp\")","description_v2":["Found PE header \"MZ\" - Source: \"00000000-00002096.00000000.69552.00010000.00000002.mdmp\")","Found PE header \"MZ\" - Source: \"00000000-00002096.00000001.71472.00010000.00000002.mdmp\")","Found PE header \"MZ\" - Source: \"00000000-00002096.00000002.73391.00010000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00002096.00000000.69552.00010000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00002096.00000001.71472.00010000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00002096.00000002.73391.00010000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found string - \\\\.\\pipe\\anonymous; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found string - \\\\.\\pipe\\PDFToolsWebPipe; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string - \\\\.\\pipe\\; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string - \\\\.\\pipe\\anonymous; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string - \\\\.\\pipe\\PDFToolsWebPipe; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\anonymous; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\PDFToolsWebPipe; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-106","type":2,"relevance":1,"name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"DownloadHelperTray\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"DownloadHelperTray\")","Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-106","type":0,"relevance":1,"name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"DownloadHelperTray\"\n Observed function \"ToBase64String\" in \"DownloadHelperTray\"","description_v2":["Observed function \"FromBase64String\" in \"DownloadHelperTray\"","Observed function \"ToBase64String\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed function \"FromBase64String\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"ToBase64String\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-357","type":2,"relevance":1,"name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray","description_v2":["Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-358","type":2,"relevance":1,"name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.GetEncryptedValueFromNameChrome\" in Source: DownloadHelperTray","description_v2":["Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.GetEncryptedValueFromNameChrome\" in Source: DownloadHelperTray"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.GetEncryptedValueFromNameChrome\" in Source: DownloadHelperTray"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-445","type":2,"relevance":1,"name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray\n Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: 6000178-TpTVkRpLRZ7VDnpPeQ~esKBihFstN","description_v2":["Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray","Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: 6000178-TpTVkRpLRZ7VDnpPeQ~esKBihFstN"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.CookieDecrypt\" in Source: DownloadHelperTray"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: 6000178-TpTVkRpLRZ7VDnpPeQ~esKBihFstN"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-166","type":0,"relevance":1,"name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-141","type":0,"relevance":1,"name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-118","type":0,"relevance":1,"name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"DownloadHelperTray\"]","description_v2":["Observed namespace \"System.Security.Cryptography\" in [Source: \"DownloadHelperTray\"]"],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography\" in [Source: \"DownloadHelperTray\"]"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-108","type":2,"relevance":1,"name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-352","type":2,"relevance":1,"name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"DownloadHelperTray\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"DownloadHelperTray\")","Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-140","type":0,"relevance":1,"name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"DownloadHelperTray\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"DownloadHelperTray\"","Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-168","type":0,"relevance":1,"name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-165","type":0,"relevance":1,"name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$26","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to decode base64 data","Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to decrypt data using RSA (Dotnet String)","Matched sigs: Contains ability to encrypt data using RSA (Dotnet String)","Matched sigs: Contains ability to perform AES decryption (Dotnet String)","Matched sigs: Contains ability to decrypt/decode data","Matched sigs: Contains ability to decode string content at runtime (Dotnet)","Matched sigs: Contains ability to perform asymmetric crypto operations","Matched sigs: Contains ability to perform crypto operations","Matched sigs: Contains ability to perform symmetric crypto operations","Matched sigs: Contains ability to perform symmetric decryption (Dotnet)","Matched sigs: Dotnet file contains encryption/decryption functions","Matched sigs: Contains ability to perform CryptoStream operations (Dotnet)","Matched sigs: Contains ability to perform symmetric encryption (Dotnet)","Matched sigs: Contains ability to perform encryption (API string)","Matched sigs: Contains reference to cryptographic keys"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform AES decryption (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decrypt/decode data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode string content at runtime (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform asymmetric crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric decryption (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dotnet file contains encryption/decryption functions"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric encryption (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"DownloadHelperTray.exe\" called \"IsWow64Process\" with parameter \"2096\" - (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"IsWow64Process\" with parameter \"2096\" - (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"IsWow64Process\" with parameter \"2096\" - (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00002096)\n \"DownloadHelperTray.exe\" called \"GetWindowTextW\" (UID: 00000000-00002096)\n \"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"WindowsFormsParkingWindow\" - (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"GetWindowTextW\" (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"WindowsFormsParkingWindow\" - (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"GetWindowTextW\" (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"GetWindowTextW\" with parameter \"WindowsFormsParkingWindow\" - (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"DownloadHelperTray.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$27","description_v2":["\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000002fb91fb123254273e0221c00687d0c7580f11c0030544273b34847c2feffffff9cf01c00b240417340f01c000000237438f11c00cb404173e0df3a7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c8f01c00000000000800000000000000000000000000000000000000000000000000237407b91fb10000000008f11c006992e873ffffffff34000000c8f01c0008000000000000000000237438f11c002794e873d0f01c000b0000000000000020f11c00 (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000a0de1c0044de1c00226e047500004804000000002d6e0475792028ae2d000000ecb7af75c8de1c0000004f02b8e96402b0256402160000008000000008de1c0000004f028cde1c0070c80575c58f3edbfeffffff2d000000d0ccbe75270000005cde1c00856a06751c230b759cde1c00f85f067508000000bb690575b2690575a12028ae2d000000ecb7af7527000000d0ccbe7570de1c002d000000d0ccbe7527000000a0de1c00856a06751c230b75e8de1c007e8abd75ee8cbd75738abd75c89be1d82d000000ecb7af7527000000d0ccbe75e428480478284804c89be1d8b0de1c00fc52fb759cdf1c00e084bd7518b404adfeffffff738abd75 (UID: 00000000-00002096)","\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000bb70187dbb7000000000d0a9b0730000a9739011aa7340e46302d8b75f02b81b6602c0e81c00feffffff68eb1c00506a097747bd852cfeffffff80e91c00eaa9057740e4630200000000b81b6602a11400000a000b00b297bb705c76bb706876bb70b81b66026860660214000000000000000000000040e46302a8e91c00cc2d0a77b81b660200000000c41b660200000000f800b47000000000cc0d24385ce80877684007779003000019000000110000001000000028bc5e02e0e91c008d9a9b7348b95e02745965020000000000ea1c0004bc5e027459650218ea1c000000b470feffffff0400000020af9b7300000000000000000300000008ea1c00 (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000002fb91fb123254273e0221c00687d0c7580f11c0030544273b34847c2feffffff9cf01c00b240417340f01c000000237438f11c00cb404173e0df3a7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c8f01c00000000000800000000000000000000000000000000000000000000000000237407b91fb10000000008f11c006992e873ffffffff34000000c8f01c0008000000000000000000237438f11c002794e873d0f01c000b0000000000000020f11c00 (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000a0de1c0044de1c00226e047500004804000000002d6e0475792028ae2d000000ecb7af75c8de1c0000004f02b8e96402b0256402160000008000000008de1c0000004f028cde1c0070c80575c58f3edbfeffffff2d000000d0ccbe75270000005cde1c00856a06751c230b759cde1c00f85f067508000000bb690575b2690575a12028ae2d000000ecb7af7527000000d0ccbe7570de1c002d000000d0ccbe7527000000a0de1c00856a06751c230b75e8de1c007e8abd75ee8cbd75738abd75c89be1d82d000000ecb7af7527000000d0ccbe75e428480478284804c89be1d8b0de1c00fc52fb759cdf1c00e084bd7518b404adfeffffff738abd75 (UID: 00000000-00002096)"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000bb70187dbb7000000000d0a9b0730000a9739011aa7340e46302d8b75f02b81b6602c0e81c00feffffff68eb1c00506a097747bd852cfeffffff80e91c00eaa9057740e4630200000000b81b6602a11400000a000b00b297bb705c76bb706876bb70b81b66026860660214000000000000000000000040e46302a8e91c00cc2d0a77b81b660200000000c41b660200000000f800b47000000000cc0d24385ce80877684007779003000019000000110000001000000028bc5e02e0e91c008d9a9b7348b95e02745965020000000000ea1c0004bc5e027459650218ea1c000000b470feffffff0400000020af9b7300000000000000000300000008ea1c00 (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"\"DownloadHelperTray.exe\" called \"GetVersionExA\" (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"GetVersionExA\" (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"GetVersionExA\" (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-114","type":0,"relevance":1,"name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Management.ManagementObjectSearcher\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-433","type":2,"relevance":1,"name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-120","type":0,"relevance":1,"name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_Is64BitOperatingSystem\" in \"DownloadHelperTray\"","description_v2":["Observed function \"get_Is64BitOperatingSystem\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed function \"get_Is64BitOperatingSystem\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"DownloadHelperTray\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"DownloadHelperTray\")\n Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"DownloadHelperTray\")","Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"DownloadHelperTray\")","Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"$28","description_v2":["Found reference to API \"FindWindowEx\" (Indicator: \"FindWindow\"; File: \"DownloadHelperTray\")","Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")","Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")","Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")","Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")","Found reference to API \"FindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API \"10707607530,2656,109,,GetWindowTextW,user32.dll,\"00:18:06.328\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowEx\" (Indicator: \"FindWindow\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"10707607530,2656,109,,GetWindowTextW,user32.dll,\"00:18:06.328\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"\"DownloadHelperTray.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\DownloadHelperTray (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\DownloadHelperTray (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\DownloadHelperTray (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-138","type":6,"relevance":3,"name":"Calls an API typically used to create an instance of a named pipe","description":"\"DownloadHelperTray.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PDFToolsWebPipe\" - (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PDFToolsWebPipe\" - (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PDFToolsWebPipe\" - (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-615","type":2,"relevance":1,"name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"DownloadHelperTray\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"DownloadHelperTray\")","Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"DownloadHelperTray.pdb\"","description_v2":["\"DownloadHelperTray.pdb\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$29","description_v2":["\"SELECT last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch'),url,title FROM urls ORDER BY last_visit_time DESC LIMIT 5;\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch')","url","title from urls order by last_visit_time desc limit 5;\"), \"SELECT last_visit_date","datetime(last_visit_date / 1000000, 'unixepoch')","url","title FROM moz_places ORDER BY last_visit_date DESC LIMIT 5;\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select last_visit_date","datetime(last_visit_date / 1000000, 'unixepoch')","url","title from moz_places order by last_visit_date desc limit 5;\"), \"SELECT url FROM urls WHERE url LIKE '%^\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select url from urls where url like '%^\"), \"SELECT url FROM moz_places WHERE url LIKE '%^\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select url from moz_places where url like '%^\"), \"SELECT name From moz_cookies WHERE host LIKE \"%8\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select name from moz_cookies where host like \"%8\")","\"SELECT name FROM cookies WHERE host_key LIKE '%@\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select name from cookies where host_key like '%@\")","\"Select * from Win32_ComputerSystem\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select * from win32_computersystem\")"],"description_v3":[{"type":"text","value":"\"SELECT last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch'),url,title FROM urls ORDER BY last_visit_time DESC LIMIT 5;\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select last_visit_time, datetime(last_visit_time / 1000000 -11644473600 , 'unixepoch')"},{"type":"linebreak"},{"type":"text","value":"url"},{"type":"linebreak"},{"type":"text","value":"title from urls order by last_visit_time desc limit 5;\"), \"SELECT last_visit_date"},{"type":"linebreak"},{"type":"text","value":"datetime(last_visit_date / 1000000, 'unixepoch')"},{"type":"linebreak"},{"type":"text","value":"url"},{"type":"linebreak"},{"type":"text","value":"title FROM moz_places ORDER BY last_visit_date DESC LIMIT 5;\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select last_visit_date"},{"type":"linebreak"},{"type":"text","value":"datetime(last_visit_date / 1000000, 'unixepoch')"},{"type":"linebreak"},{"type":"text","value":"url"},{"type":"linebreak"},{"type":"text","value":"title from moz_places order by last_visit_date desc limit 5;\"), \"SELECT url FROM urls WHERE url LIKE '%^\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select url from urls where url like '%^\"), \"SELECT url FROM moz_places WHERE url LIKE '%^\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select url from moz_places where url like '%^\"), \"SELECT name From moz_cookies WHERE host LIKE \"%8\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select name from moz_cookies where host like \"%8\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT name FROM cookies WHERE host_key LIKE '%@\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select name from cookies where host_key like '%@\")"},{"type":"linebreak"},{"type":"text","value":"\"Select * from Win32_ComputerSystem\" (Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp, Indicator: \"select * from win32_computersystem\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"DownloadHelperTray\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"DownloadHelperTray\")","Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$2a","description_v2":["Found reference to API (Indicator: \"FindWindowEx\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"SetWindowPos\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"SetParent\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"EnumThreadWindows\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"GetWindowTextLength\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"SendMessage\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"SetWindowLong\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"GetWindowLong\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"CreateDirectory\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"Sleep\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"MessageBox\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"RegisterWindowMessage\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"RegisterWindowMessageA\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"GetWindowTextA\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"EnumChildWindows\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"DownloadHelperTray\")","Found reference to API (Indicator: \"FindWindowEx\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"SetParent\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumThreadWindows\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowTextLength\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"SendMessage\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowLong\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowLong\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterWindowMessage\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterWindowMessageA\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowTextA\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumChildWindows\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"FindWindowEx\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetParent\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumThreadWindows\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowText\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextLength\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessage\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowLong\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowLong\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectory\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessage\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessageA\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextA\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumChildWindows\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindWindowEx\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetParent\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumThreadWindows\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowText\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextLength\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessage\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowLong\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowLong\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessage\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessageA\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextA\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumChildWindows\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DownloadHelperTray\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DownloadHelperTray\")","Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-111","type":0,"relevance":1,"name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"DownloadHelperTray\"\n Observed function \"Process.Start\" in \"DownloadHelperTray\"","description_v2":["Observed function \"Process.get_StartInfo\" in \"DownloadHelperTray\"","Observed function \"Process.Start\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed function \"Process.get_StartInfo\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"Process.Start\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$2b","description_v2":["\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Langu\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp","00000000-00002096.00000001.71472.000C8000.00000004.mdmp","00000000-00002096.00000002.73391.000C8000.00000004.mdmp","\"1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp","00000000-00002096.00000001.71472.000C8000.00000004.mdmp","00000000-00002096.00000002.73391.000C8000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microv\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp","00000000-00002096.00000001.71472.000C8000.00000004.mdmp","00000000-00002096.00000002.73391.000C8000.00000004.mdmp","\"Y\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp","00000000-00002096.00000001.71472.000C8000.00000004.mdmp","00000000-00002096.00000002.73391.000C8000.00000004.mdmp","\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00002096.00000000.69552.024E0000.00000004.mdmp","00000000-00002096.00000001.71472.024E0000.00000004.mdmp","00000000-00002096.00000002.73391.024E0000.00000004.mdmp","\"E\\SOFTWARE\\Microsoft\\Windows NT\\ttrr\" in Source: 00000000-00002096.00000000.69552.043D8000.00000004.mdmp","00000000-00002096.00000001.71472.043D8000.00000004.mdmp","00000000-00002096.00000002.73391.043D8000.00000004.mdmp","\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Classes\\Applications\\firefox.exe\\shell\\open\\commandH\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"HKEY_CLASSES_ROOT\\ChromeHTML\\shell\\open\\command>\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\XML\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"Software\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.Servic\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v{0}\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SystemDefaultTlsVersions\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp","\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp","00000000-00002096.00000001.71472.06EE0000.00000004.mdmp","00000000-00002096.00000002.73391.06EE0000.00000004.mdmp","\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp","00000000-00002096.00000001.71472.06EE0000.00000004.mdmp","00000000-00002096.00000002.73391.06EE0000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Langu\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microv\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Y\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\\" in Source: 00000000-00002096.00000000.69552.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00002096.00000000.69552.024E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.024E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.024E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"E\\SOFTWARE\\Microsoft\\Windows NT\\ttrr\" in Source: 00000000-00002096.00000000.69552.043D8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.043D8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.043D8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Classes\\Applications\\firefox.exe\\shell\\open\\commandH\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_CLASSES_ROOT\\ChromeHTML\\shell\\open\\command>\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\XML\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.Servic\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v{0}\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SystemDefaultTlsVersions\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol\" in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.06EE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.06EE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00002096.00000000.69552.06EE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.06EE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.06EE0000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-138","type":0,"relevance":1,"name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"DownloadHelperTray\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"DownloadHelperTray\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"DownloadHelperTray\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"DownloadHelperTray\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"DownloadHelperTray\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"DownloadHelperTray\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"DownloadHelperTray\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"DownloadHelperTray\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-126","type":0,"relevance":1,"name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"DownloadHelperTray\"\n Observed API \"GetProcAddress\" in \"DownloadHelperTray\"","description_v2":["Observed API \"LoadLibrary\" in \"DownloadHelperTray\"","Observed API \"GetProcAddress\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed API \"LoadLibrary\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed API \"GetProcAddress\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"DownloadHelperTray\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","description_v2":["\"DownloadHelperTray\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-101","type":0,"relevance":1,"name":"Found Native API in Dotnet file","description":"$2c","description_v2":["Observed unmanaged function \"FindWindowEx\" in \"DownloadHelperTray\"","Observed unmanaged function \"SetLayeredWindowAttributes\" in \"DownloadHelperTray\"","Observed unmanaged function \"ShowWindow\" in \"DownloadHelperTray\"","Observed unmanaged function \"SetForegroundWindow\" in \"DownloadHelperTray\"","Observed unmanaged function \"SetWindowPos\" in \"DownloadHelperTray\"","Observed unmanaged function \"SetParent\" in \"DownloadHelperTray\"","Observed unmanaged function \"EnumThreadWindows\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetWindowText\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetWindowTextLength\" in \"DownloadHelperTray\"","Observed unmanaged function \"SendMessage\" in \"DownloadHelperTray\"","Observed unmanaged function \"SetWindowLong\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetWindowLong\" in \"DownloadHelperTray\"","Observed unmanaged function \"RegisterWindowMessageA\" in \"DownloadHelperTray\"","Observed unmanaged function \"DeregisterShellHookWindow\" in \"DownloadHelperTray\"","Observed unmanaged function \"RegisterShellHookWindow\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetWindowTextA\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetWindowTextLengthA\" in \"DownloadHelperTray\"","Observed unmanaged function \"EnumChildWindows\" in \"DownloadHelperTray\"","Observed unmanaged function \"LoadLibrary\" in \"DownloadHelperTray\"","Observed unmanaged function \"GetProcAddress\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed unmanaged function \"FindWindowEx\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetLayeredWindowAttributes\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"ShowWindow\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetForegroundWindow\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetWindowPos\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetParent\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"EnumThreadWindows\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowText\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowTextLength\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SendMessage\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetWindowLong\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowLong\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"RegisterWindowMessageA\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"DeregisterShellHookWindow\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"RegisterShellHookWindow\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowTextA\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowTextLengthA\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"EnumChildWindows\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"LoadLibrary\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetProcAddress\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\\n Found string - \\\\.\\pipe\\anonymous\n Found string - \\\\.\\pipe\\PDFToolsWebPipe","description_v2":["Found string - \\\\.\\pipe\\","Found string - \\\\.\\pipe\\anonymous","Found string - \\\\.\\pipe\\PDFToolsWebPipe"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\anonymous"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\PDFToolsWebPipe"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-127","type":2,"relevance":1,"name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0^\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0^\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0^\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6F650000","description_v2":["\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6F650000"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6F650000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74170000\n \"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72140000","description_v2":["\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74170000","\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72140000"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74170000"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72140000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-7","type":10,"relevance":0,"name":"Loads the CLR Loader DLL","description":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 718D0000","description_v2":["\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 718D0000"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 718D0000"}],"origin":"Loaded Module","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754F0000","description_v2":["\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754F0000"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754F0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"DownloadHelperTray\" was detected as \".NET\" and name: \"Library\"\n \"DownloadHelperTray\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"DownloadHelperTray\" was detected as \".NET\" and name: \"Library\"","\"DownloadHelperTray\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" was detected as \".NET\" and name: \"Library\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-144","type":0,"relevance":1,"name":"PE file contains COM data directory","description":"\"DownloadHelperTray\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","description_v2":["\"DownloadHelperTray\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-146","type":0,"relevance":0,"name":"PE file contains Debug data directory","description":"\"DownloadHelperTray\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","description_v2":["\"DownloadHelperTray\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"DownloadHelperTray\" has an executable section named \".text\"","description_v2":["\"DownloadHelperTray\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"$2d","description_v2":["$2e"],"description_v3":[{"type":"text","value":"$2f"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"$30","description_v2":["\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"KO-KR\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"KO-KR\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-CN\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-CN\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-HK\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-HK\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"JA-JP\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"JA-JP\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"KO-KR\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"KO-KR\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-CN\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-CN\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-HK\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-HK\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"JA-JP\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"JA-JP\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows filepaths for DLLs (possible dropped files)","description":"$31","description_v2":["Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002096-00000C28-1271573220]","Observed system executable string:\"3,\"System","Version=4.0.0.0","Culture=neutral","PublicKeyToken=b77a5c561934e089\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]","Observed system executable string:\"3,\"System.Core","Version=4.0.0.0","Culture=neutral","PublicKeyToken=b77a5c561934e089\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]","Observed system executable string:\"3,\"System.Configuration","Version=4.0.0.0","Culture=neutral","PublicKeyToken=b03f5f7f11d50a3a\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]","Observed system executable string:\"3,\"System.Xml","Version=4.0.0.0","Culture=neutral","PublicKeyToken=b77a5c561934e089\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002096-00000C28-1271573220]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"3,\"System"},{"type":"linebreak"},{"type":"text","value":"Version=4.0.0.0"},{"type":"linebreak"},{"type":"text","value":"Culture=neutral"},{"type":"linebreak"},{"type":"text","value":"PublicKeyToken=b77a5c561934e089\",\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"3,\"System.Core"},{"type":"linebreak"},{"type":"text","value":"Version=4.0.0.0"},{"type":"linebreak"},{"type":"text","value":"Culture=neutral"},{"type":"linebreak"},{"type":"text","value":"PublicKeyToken=b77a5c561934e089\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"3,\"System.Configuration"},{"type":"linebreak"},{"type":"text","value":"Version=4.0.0.0"},{"type":"linebreak"},{"type":"text","value":"Culture=neutral"},{"type":"linebreak"},{"type":"text","value":"PublicKeyToken=b03f5f7f11d50a3a\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"3,\"System.Xml"},{"type":"linebreak"},{"type":"text","value":"Version=4.0.0.0"},{"type":"linebreak"},{"type":"text","value":"Culture=neutral"},{"type":"linebreak"},{"type":"text","value":"PublicKeyToken=b77a5c561934e089\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll\",0\" [Source: DownloadHelperTray.exe.log]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 87:A6:3D:9A:DB:62:7D:77:78:36:15:3C:68:0A:3D:FC:F2:7D:E9:0C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE\" (SHA1: 1F:23:01:43:E3:D8:32:A2:59:D2:94:75:BE:AC:49:88:E5:ED:3E:F3; see report for more information)","description_v2":["The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 87:A6:3D:9A:DB:62:7D:77:78:36:15:3C:68:0A:3D:FC:F2:7D:E9:0C; see report for more information)","The input sample is signed with a certificate issued by \"CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE\" (SHA1: 1F:23:01:43:E3:D8:32:A2:59:D2:94:75:BE:AC:49:88:E5:ED:3E:F3; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 87:A6:3D:9A:DB:62:7D:77:78:36:15:3C:68:0A:3D:FC:F2:7D:E9:0C; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE\" (SHA1: 1F:23:01:43:E3:D8:32:A2:59:D2:94:75:BE:AC:49:88:E5:ED:3E:F3; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-2","type":17,"relevance":10,"name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","description_v2":["The entire certificate chain of the input sample was validated successfully."],"description_v3":[{"type":"text","value":"The entire certificate chain of the input sample was validated successfully."}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"DownloadHelperTray\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"DownloadHelperTray\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")","Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"DownloadHelperTray.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]","description_v2":["\"DownloadHelperTray.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$32","description_v2":["\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$33","description_v2":["\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"DOWNLOADHELPERTRAY.EXE\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")","\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"DOWNLOADHELPERTRAY.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"\n \"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\"","description_v2":["\"DownloadHelperTray.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"","\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"","\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"","\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"","\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"","\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"%WINDIR%\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"DownloadHelperTray.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\DownloadHelperTray.exe\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"DownloadHelperTray.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"","description_v2":["\"DownloadHelperTray.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\DownloadHelperTray.exe\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","\"DownloadHelperTray.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"","\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\DownloadHelperTray.exe\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"Z:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$34","description_v2":["\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UCRTBASE_CLR0400.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSCOREE.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\OLE32.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\RPCSS.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\UXTHEME.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\SHELL32.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\BCRYPT.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\CRYPTSP.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\DWRITE.DLL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\PSAPI.DLL\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UCRTBASE_CLR0400.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSCOREE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\OLE32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\SysWOW64\\RPCSS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\UXTHEME.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\SHELL32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\BCRYPT.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\DWRITE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\PSAPI.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$35","description_v2":["\"DownloadHelperTray.exe\" trying to access non-existent file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\DOWNLOADHELPERTRAY.EXE.CONFIG\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FUSION.LOCALGAC\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DOWNLOADHELPERTRAY.EXE.LOG\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\assembly\\NativeImages_v4.0.30319_32\\DOWNLOADHELPERTRAY\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\DOWNLOADHELPERTRAY.INI\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.WINDOWS.FORMS\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\SYSTEM.WINDOWS.FORMS.INI\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.DRAWING\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\SYSTEM.DRAWING.INI\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\DOWNLOADHELPERTRAY.EXE.LOCAL\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ACCESSIBILITY\"","\"DownloadHelperTray.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\ACCESSIBILITY.INI\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\DOWNLOADHELPERTRAY.EXE.CONFIG\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FUSION.LOCALGAC\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DOWNLOADHELPERTRAY.EXE.LOG\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\DOWNLOADHELPERTRAY\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\DOWNLOADHELPERTRAY.INI\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.WINDOWS.FORMS\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\SYSTEM.WINDOWS.FORMS.INI\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.DRAWING\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\SYSTEM.DRAWING.INI\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\DOWNLOADHELPERTRAY.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ACCESSIBILITY\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" trying to access non-existent file \"Z:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\ACCESSIBILITY.INI\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"DownloadHelperTray.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\"\n \"DownloadHelperTray.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\"","description_v2":["\"DownloadHelperTray.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\"","\"DownloadHelperTray.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" writes file \"%LOCALAPPDATA%\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\downloadhelpertray.exe.log\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-159","type":6,"relevance":1,"name":"Writes log files","description":"\"DownloadHelperTray.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\"\n \"DownloadHelperTray.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\"","description_v2":["\"DownloadHelperTray.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\"","\"DownloadHelperTray.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\""},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log\""}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-158","type":0,"relevance":1,"name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_KeepAlive\" in \"DownloadHelperTray\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"DownloadHelperTray\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"DownloadHelperTray\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"DownloadHelperTray\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\"","description_v2":["Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_KeepAlive\" in \"DownloadHelperTray\"","Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"DownloadHelperTray\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"DownloadHelperTray\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"DownloadHelperTray\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_KeepAlive\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-110","type":0,"relevance":1,"name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"DownloadHelperTray\"","description_v2":["Observed namespace \"System.Net\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Net\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-142","type":0,"relevance":1,"name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\"","description_v2":["Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-323","type":2,"relevance":1,"name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"DownloadHelperTray\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"DownloadHelperTray\")","Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$36","description_v2":["Pattern match: \"http://ocsp2.globalsign.com/rootr306\"","Pattern match: \"http://crl.globalsign.com/root-r3.crl0b\"","Pattern match: \"https://www.globalsign.com/repository/0\"","Pattern match: \"secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0\"","Pattern match: \"ocsp2.globalsign.com/gsextendcodesignsha2g30U\"","Pattern match: \"crl.globalsign.com/gsextendcodesignsha2g3.crl0\"","Pattern match: \"http://ocsp.globalsign.com/ca/gstsacasha384g40C\"","Pattern match: \"secure.globalsign.com/cacert/gstsacasha384g4.crt0\"","Pattern match: \"crl.globalsign.com/ca/gstsacasha384g4.crl0\"","Pattern match: \"http://ocsp2.globalsign.com/rootr606\"","Pattern match: \"http://crl.globalsign.com/root-r6.crl0G\"","Pattern match: \"http://crl.globalsign.com/root-r3.crl0G\"","Pattern match: \"Microsoft.NET/Framework/v4.0.30319/\"","Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","Heuristic match: \"ws@.ws\"","Pattern match: \"https://www\"","Pattern match: \"https://location.cdnawsco.com/full/o0DrSUwBOXH750CT8fGz0UnMeEXd3UU685ZI4WL7Yl0/\"","Pattern match: \"https://location.cdnawsco.com/selfip/EfT5lo9lKLCDLJVYUqeH95L4SrkG805vMiPEC6HqzMs\"","Pattern match: \"https://saedion.com/api\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=42127\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#dsa-sha1\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha384\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#sha1\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#sha256\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#sha512\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#ripemd160\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#des-cbc\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#tripledes-cbc\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-tripledes\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes128-cbc\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes128\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes192-cbc\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes192\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes256-cbc\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes256\"","Pattern match: \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\"","Pattern match: \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\"","Pattern match: \"http://www.w3.org/2001/10/xml-exc-c14n#\"","Pattern match: \"http://www.w3.org/2001/10/xml-exc-c14n#WithComments\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#base64\"","Pattern match: \"http://www.w3.org/TR/1999/REC-xpath-19991116\"","Pattern match: \"http://www.w3.org/TR/1999/REC-xslt-19991116\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"","Pattern match: \"http://www.w3.org/2002/07/decrypt#XML\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#\"","Pattern match: \"http://www.w3.org/2001/04/xmlenc#\"","Pattern match: \"http://www.w3.org/2000/09/xmldsig#hmac-sha1\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#md5\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#sha384\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-md5\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha384\"","Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha512\"","Pattern match: \"http://www.w3.org/2000/xmlns/\"","Pattern match: \"http://www.w3.org/XML/1998/namespace\"","Pattern match: \"http://schemas.microsoft.com/.NetConfiguration/v2.0\"","Pattern match: \"system.web/anonymousIdentification\"","Pattern match: \"system.web/authentication\"","Pattern match: \"system.web/authorization\"","Pattern match: \"system.web/browserCaps\"","Pattern match: \"system.web/clientTarget\"","Pattern match: \"system.web/compilation\"","Pattern match: \"system.web/customErrors\"","Pattern match: \"system.web/deployment\"","Pattern match: \"system.web/deviceFilters\"","Pattern match: \"system.web/fullTrustAssemblies\"","Pattern match: \"system.web/globalization\"","Pattern match: \"system.web/healthMonitoring\"","Pattern match: \"system.web/hostingEnvironment\"","Pattern match: \"system.web/httpCookies\"","Pattern match: \"system.web/httpHandlers\"","Pattern match: \"system.web/httpModules\"","Pattern match: \"system.web/httpRuntime\"","Pattern match: \"system.web/identity\"","Pattern match: \"system.web/machineKey\"","Pattern match: \"system.web/membership\"","Pattern match: \"system.web/mobileControls\"","Pattern match: \"system.web/pages\"","Pattern match: \"system.web/partialTrustVisibleAssemblies\"","Pattern match: \"system.web/processModel\"","Pattern match: \"system.web/profile\"","Pattern match: \"system.web/protocols\"","Pattern match: \"system.web/roleManager\"","Pattern match: \"system.web/securityPolicy\"","Pattern match: \"system.web/sessionPageState\"","Pattern match: \"system.web/sessionState\"","Pattern match: \"system.web/siteMap\"","Pattern match: \"system.web/trace\"","Pattern match: \"system.web/trust\"","Pattern match: \"system.web/urlMappings\"","Pattern match: \"system.web/webControls\"","Pattern match: \"system.web/webParts\"","Pattern match: \"system.web/webServices\"","Pattern match: \"system.web/xhtmlConformance\"","Pattern match: \"system.web/caching\"","Pattern match: \"system.web/caching/cache\"","Pattern match: \"system.web/caching/outputCache\"","Pattern match: \"system.web/caching/outputCacheSettings\"","Pattern match: \"system.web/caching/sqlCacheDependency\"","Heuristic match: \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\"","Pattern match: \"https://fs.microsoft.com/fs/windows/config.json\"","Pattern match: \"https://fs.microsoft.com/fs/windows/config.json,config,0\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://ocsp2.globalsign.com/rootr306\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.com/root-r3.crl0b\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.globalsign.com/repository/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"ocsp2.globalsign.com/gsextendcodesignsha2g30U\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.globalsign.com/gsextendcodesignsha2g3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.globalsign.com/ca/gstsacasha384g40C\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"secure.globalsign.com/cacert/gstsacasha384g4.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.globalsign.com/ca/gstsacasha384g4.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp2.globalsign.com/rootr606\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.com/root-r6.crl0G\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.com/root-r3.crl0G\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"Microsoft.NET/Framework/v4.0.30319/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ws@.ws\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://location.cdnawsco.com/full/o0DrSUwBOXH750CT8fGz0UnMeEXd3UU685ZI4WL7Yl0/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://location.cdnawsco.com/selfip/EfT5lo9lKLCDLJVYUqeH95L4SrkG805vMiPEC6HqzMs\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://saedion.com/api\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=42127\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#dsa-sha1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#rsa-sha1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha384\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#sha1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#sha256\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#sha512\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#ripemd160\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#des-cbc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#tripledes-cbc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-tripledes\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes128-cbc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes128\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes192-cbc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes192\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#aes256-cbc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#kw-aes256\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/10/xml-exc-c14n#\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/10/xml-exc-c14n#WithComments\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#base64\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/TR/1999/REC-xpath-19991116\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/TR/1999/REC-xslt-19991116\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#enveloped-signature\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2002/07/decrypt#XML\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmlenc#\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/09/xmldsig#hmac-sha1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#md5\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#sha384\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-md5\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha384\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/04/xmldsig-more#hmac-sha512\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/xmlns/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/XML/1998/namespace\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/.NetConfiguration/v2.0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/anonymousIdentification\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/authentication\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/authorization\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/browserCaps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/clientTarget\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/compilation\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/customErrors\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/deployment\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/deviceFilters\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/fullTrustAssemblies\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/globalization\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/healthMonitoring\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/hostingEnvironment\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/httpCookies\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/httpHandlers\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/httpModules\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/httpRuntime\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/identity\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/machineKey\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/membership\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/mobileControls\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/pages\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/partialTrustVisibleAssemblies\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/processModel\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/profile\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/protocols\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/roleManager\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/securityPolicy\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/sessionPageState\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/sessionState\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/siteMap\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/trace\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/trust\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/urlMappings\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/webControls\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/webParts\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/webServices\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/xhtmlConformance\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/caching\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/caching/cache\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/caching/outputCache\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/caching/outputCacheSettings\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"system.web/caching/sqlCacheDependency\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://fs.microsoft.com/fs/windows/config.json\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://fs.microsoft.com/fs/windows/config.json,config,0\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$37","description_v2":["Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp\")","Found URL \"https://www.\" - Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp\")","Found URL \"https://location.cdnawsco.com/full/o0drsuwboxh750ct8fgz0unmeexd3uu685zi4wl7yl0/https://location.cdnawsco.com/selfip/eft5lo9lklcdljvyuqeh95l4srkg805vmipec6hqzms\\\\\\/http(s\" - Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp\")","Found URL \"https://saedion.com/apipdftoolswebpipedata\" - Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp\")","Found URL \"https:///postback?cid=caid=-clk/postback?caid=*&attribution=cid-caidmozilla/5.0\" - Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp\")","Found URL \"https://saedion.com/apipdftoolswebpipefulltrustfulltrustinternetnothingexecutionskipverificationlocalintraneteverythingmscorlib.resourcessystemsystem.resourcessystem.xmlsystem.xml.resourcessystem.windows.formssystem.windows.forms.resourcessystem.datasystem.data.resourcessystem.securitysystem.security.resourcessystem.drawingsystem.drawing.resourcessystem.messagingsystem.messaging.resourcessystem.serviceprocesssystem.serviceprocess.resourcessystem.directoryservicessystem.directoryservices.resourcessystem.deploymentsystem.deployment.resources\" (Indicator: \"GetDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"DownloadHelperTray\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"DownloadHelperTray\")","Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-100","type":0,"relevance":1,"name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"DownloadHelperTray\"\n Observed function \"get_ProcessName\" in \"DownloadHelperTray\"","description_v2":["Observed function \"GetProcessById\" in \"DownloadHelperTray\"","Observed function \"get_ProcessName\" in \"DownloadHelperTray\""],"description_v3":[{"type":"text","value":"Observed function \"GetProcessById\" in \"DownloadHelperTray\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"get_ProcessName\" in \"DownloadHelperTray\""}],"origin":"Static Parser","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DownloadHelperTray\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DownloadHelperTray\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DownloadHelperTray\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002096.00000000.69552.00012000.00000002.mdmp, 00000000-00002096.00000001.71472.00012000.00000002.mdmp, 00000000-00002096.00000002.73391.00012000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-475","type":2,"relevance":1,"name":"Contains string like password/secret","description":"$3b","description_v2":["Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-96","type":2,"relevance":1,"name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp\n 00000000-00002096.00000001.71472.04590000.00000004.mdmp\n 00000000-00002096.00000002.73391.04590000.00000004.mdmp","description_v2":["\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp","00000000-00002096.00000001.71472.04590000.00000004.mdmp","00000000-00002096.00000002.73391.04590000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002096.00000000.69552.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.04590000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.04590000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"registry-106","type":3,"relevance":3,"name":"Read system defined device setup information from registry","description":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","description_v2":["\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-507","type":2,"relevance":1,"name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-111","type":6,"relevance":3,"name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"DownloadHelperTray.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002096)","description_v2":["\"DownloadHelperTray.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002096)"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002096)"}],"origin":"API Call","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")","description_v2":["Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000001.71472.025E0000.00000004.mdmp, 00000000-00002096.00000002.73391.025E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-77","type":2,"relevance":1,"name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002096.00000000.69552.025E0000.00000004.mdmp, 00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")","description_v2":["\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"binary-37","type":8,"relevance":3,"name":"Drops files inside appdata directory","description":"Dropped file: \"DownloadHelperTray.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]","description_v2":["Dropped file: \"DownloadHelperTray.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]"],"description_v3":[{"type":"text","value":"Dropped file: \"DownloadHelperTray.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DownloadHelperTray.exe.log]- [targetUID: 00000000-00002096]"}],"origin":"Binary File","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"DownloadHelperTray\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","description_v2":["\"DownloadHelperTray\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","description_v2":["\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":3,"name":"PE file has unusual entropy sections","description":".reloc with unusual entropies 0.101910425663","description_v2":[".reloc with unusual entropies 0.101910425663"],"description_v3":[{"type":"text","value":".reloc with unusual entropies 0.101910425663"}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"string-55","type":2,"relevance":10,"name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":0,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/63 Antivirus vendors marked sample as malicious (4% detection rate)","description_v2":["3/63 Antivirus vendors marked sample as malicious (4% detection rate)"],"description_v3":[{"type":"text","value":"3/63 Antivirus vendors marked sample as malicious (4% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"string-4","type":2,"relevance":4,"name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp\n 00000000-00002096.00000001.71472.02F00000.00000002.mdmp\n 00000000-00002096.00000002.73391.02F00000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp\n 00000000-00002096.00000001.71472.02F00000.00000002.mdmp\n 00000000-00002096.00000002.73391.02F00000.00000002.mdmp","description_v2":["\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp","00000000-00002096.00000001.71472.02F00000.00000002.mdmp","00000000-00002096.00000002.73391.02F00000.00000002.mdmp","\"!Progman\" (Program manager) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp","00000000-00002096.00000001.71472.02F00000.00000002.mdmp","00000000-00002096.00000002.73391.02F00000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.02F00000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.02F00000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"!Progman\" (Program manager) in Source: 00000000-00002096.00000000.69552.02F00000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000001.71472.02F00000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002096.00000002.73391.02F00000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1055.011","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"string-14","type":2,"relevance":3,"name":"Found potential IP address in binary/memory","description":"\"1.0.1.0\"\n \"16.0.0.0\"\n \"16.8.1.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"4.0.0.0\"","description_v2":["\"1.0.1.0\"","\"16.0.0.0\"","\"16.8.1.0\"","Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"","\"2.5.29.10\"","\"2.5.29.19\"","\"2.5.29.14\"","\"2.5.29.15\"","\"2.5.29.37\"","\"4.0.0.0\""],"description_v3":[{"type":"text","value":"\"1.0.1.0\""},{"type":"linebreak"},{"type":"text","value":"\"16.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"16.8.1.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"4.0.0.0\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-20","type":1,"relevance":5,"name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at 72248e24644abcdc01b3effe0f876b1a-600001b-Form1~PpDptFh5D","description_v2":["System.Diagnostics.Process::GetProcessById(System.Int32) at 72248e24644abcdc01b3effe0f876b1a-600001b-Form1~PpDptFh5D"],"description_v3":[{"type":"text","value":"System.Diagnostics.Process::GetProcessById(System.Int32) at 72248e24644abcdc01b3effe0f876b1a-600001b-Form1~PpDptFh5D"}],"origin":"Hybrid Analysis Technology","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"string-126","type":2,"relevance":3,"name":"Found system commands related strings","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")","description_v2":["Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00002096.00000000.69552.04590000.00000004.mdmp, 00000000-00002096.00000001.71472.04590000.00000004.mdmp, 00000000-00002096.00000002.73391.04590000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"$3c","description_v2":["\"DownloadHelperTray.exe\" wrote bytes \"f04c1775c056177530081775c0611675606e177500551775504f1775f0431775501a177550b51975c01b1775f031177550671775\" to virtual address \"0x7424E164\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"c0022e7460062e74\" to virtual address \"0x758D004C\" (part of module \"COMBASE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"907c1775002b17750039177570a21775b0af1775708c147550741475d0d0197560af177580801775b0841775f05f177530a31775\" to virtual address \"0x7424E060\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"40d22d74300d2e74e0f62d74c0cd2d74\" to virtual address \"0x748E16C4\" (part of module \"WINDOWS.STORAGE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"1032047780ec0877208a057700000000\" to virtual address \"0x740B3000\" (part of module \"WIN32U.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"1075526e\" to virtual address \"0x738CE000\" (part of module \"GDIPLUS.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"30ae1874\" to virtual address \"0x755A1094\" (part of module \"RPCRT4.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"408a6575\" to virtual address \"0x72E101B0\" (part of module \"COMCTL32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"97cee9e5\" to virtual address \"0x718DF798\" (part of module \"CLR.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"801f1675a05a1775e0941775d07b1775b01e1675d01d1675f0e31975703f177550fa1475a0801575\" to virtual address \"0x7424E138\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"708c2275503c2275c02d2275908f2275c0202275b09522753025227570472275402d2275f0bb227530492275a026227540942275308e2275c080227550b82275d0272275c0ce2275f0262275d0942275a0842275\" to virtual address \"0x72E10100\" (part of module \"COMCTL32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"705b2374906a237440372374f06b237470682374d06a2374e0452374e03a2374e0682374b0692374b06b2374b0552374506a2374b0712374406b237430692374806d2374707a237490372374\" to virtual address \"0x7523D000\" (part of module \"IMM32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"a0926103b0926103b017010080f00600c0020100b0f0060060b20600e0916103f0916103\" to virtual address \"0x73B0AC94\" (part of module \"USER32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"e03a1775e0021775f03d1775\" to virtual address \"0x7424E000\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"10f2aa7300b9a973f0910a77109daa739092aa73c0b4aa735088aa73d067aa7340b2aa73209caa73108caa73a0a4aa73507caa7350a9aa73c0b3aa73805daa73c0e6aa739075aa73c0eeaa73a0c4aa7300c0aa7310d2a97360aaaa73\" to virtual address \"0x758D0228\" (part of module \"COMBASE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"50651a7510ed16758072177570c61975\" to virtual address \"0x7424E04C\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"d04c757270647572f0407572003f7572205d7572606b7572f0287672c03c7572\" to virtual address \"0x73542078\" (part of module \"UXTHEME.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"1036a6732036a673\" to virtual address \"0x758D01A0\" (part of module \"COMBASE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"70ebaa7300ecaa7340ecaa73\" to virtual address \"0x758D01FC\" (part of module \"COMBASE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"e02aa373f029a373702aa373\" to virtual address \"0x70BF700C\" (part of module \"RSAENH.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"00891775\" to virtual address \"0x7424E010\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"b07f6675d07f6675b0596a75\" to virtual address \"0x748E1778\" (part of module \"WINDOWS.STORAGE.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"10761775a05f177530d51475f0561475a0e71975e07b1475b0d61975b024157510451775204d177590e51975\" to virtual address \"0x7424E19C\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"309f1775f0661a75702a167520a4177570231675003b177510601775b05b177500b01775805b1775d0811775d00d1575\" to virtual address \"0x7424E018\" (part of module \"GDI32.DLL\")","\"DownloadHelperTray.exe\" wrote bytes \"d0e41775c0e41775a0dc177520b1177590af1775f0561775e0861b7520c7177540ec177520ee1775\" to virtual address \"0x7424E958\" (part of module \"GDI32.DLL\")"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"f04c1775c056177530081775c0611675606e177500551775504f1775f0431775501a177550b51975c01b1775f031177550671775\" to virtual address \"0x7424E164\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"c0022e7460062e74\" to virtual address \"0x758D004C\" (part of module \"COMBASE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"907c1775002b17750039177570a21775b0af1775708c147550741475d0d0197560af177580801775b0841775f05f177530a31775\" to virtual address \"0x7424E060\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"40d22d74300d2e74e0f62d74c0cd2d74\" to virtual address \"0x748E16C4\" (part of module \"WINDOWS.STORAGE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"1032047780ec0877208a057700000000\" to virtual address \"0x740B3000\" (part of module \"WIN32U.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"1075526e\" to virtual address \"0x738CE000\" (part of module \"GDIPLUS.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"30ae1874\" to virtual address \"0x755A1094\" (part of module \"RPCRT4.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"408a6575\" to virtual address \"0x72E101B0\" (part of module \"COMCTL32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"97cee9e5\" to virtual address \"0x718DF798\" (part of module \"CLR.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"801f1675a05a1775e0941775d07b1775b01e1675d01d1675f0e31975703f177550fa1475a0801575\" to virtual address \"0x7424E138\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"708c2275503c2275c02d2275908f2275c0202275b09522753025227570472275402d2275f0bb227530492275a026227540942275308e2275c080227550b82275d0272275c0ce2275f0262275d0942275a0842275\" to virtual address \"0x72E10100\" (part of module \"COMCTL32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"705b2374906a237440372374f06b237470682374d06a2374e0452374e03a2374e0682374b0692374b06b2374b0552374506a2374b0712374406b237430692374806d2374707a237490372374\" to virtual address \"0x7523D000\" (part of module \"IMM32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"a0926103b0926103b017010080f00600c0020100b0f0060060b20600e0916103f0916103\" to virtual address \"0x73B0AC94\" (part of module \"USER32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"e03a1775e0021775f03d1775\" to virtual address \"0x7424E000\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"10f2aa7300b9a973f0910a77109daa739092aa73c0b4aa735088aa73d067aa7340b2aa73209caa73108caa73a0a4aa73507caa7350a9aa73c0b3aa73805daa73c0e6aa739075aa73c0eeaa73a0c4aa7300c0aa7310d2a97360aaaa73\" to virtual address \"0x758D0228\" (part of module \"COMBASE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"50651a7510ed16758072177570c61975\" to virtual address \"0x7424E04C\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"d04c757270647572f0407572003f7572205d7572606b7572f0287672c03c7572\" to virtual address \"0x73542078\" (part of module \"UXTHEME.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"1036a6732036a673\" to virtual address \"0x758D01A0\" (part of module \"COMBASE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"70ebaa7300ecaa7340ecaa73\" to virtual address \"0x758D01FC\" (part of module \"COMBASE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"e02aa373f029a373702aa373\" to virtual address \"0x70BF700C\" (part of module \"RSAENH.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"00891775\" to virtual address \"0x7424E010\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"b07f6675d07f6675b0596a75\" to virtual address \"0x748E1778\" (part of module \"WINDOWS.STORAGE.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"10761775a05f177530d51475f0561475a0e71975e07b1475b0d61975b024157510451775204d177590e51975\" to virtual address \"0x7424E19C\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"309f1775f0661a75702a167520a4177570231675003b177510601775b05b177500b01775805b1775d0811775d00d1575\" to virtual address \"0x7424E018\" (part of module \"GDI32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"DownloadHelperTray.exe\" wrote bytes \"d0e41775c0e41775a0dc177520b1177590af1775f0561775e0861b7520c7177540ec177520ee1775\" to virtual address \"0x7424E958\" (part of module \"GDI32.DLL\")"}],"origin":"Hook Detection","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-3","type":0,"relevance":10,"name":"Timestamp in PE header is very old or in the future","description":"\"DownloadHelperTray\" claims program is from Fri Dec 4 04:10:49 2105","description_v2":["\"DownloadHelperTray\" claims program is from Fri Dec 4 04:10:49 2105"],"description_v3":[{"type":"text","value":"\"DownloadHelperTray\" claims program is from Fri Dec 4 04:10:49 2105"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"10.2.1","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["Found a string that may be used as part of an injection method"]},{"name":"Persistence","details":["Installs hooks/patches the running process"]},{"name":"Evasive","details":["Found a reference to a WMI query string known to be used for VM detection"]}],"icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","visualization":"$3d","classification":["67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.)","9.7% (.EXE) Win64 Executable (generic)","6.0% (.DLL) Win32 Dynamic Link Library (generic)","4.6% (.EXE) Win16 NE executable (generic)","4.1% (.EXE) Win32 Executable (generic)"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjYwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMTYtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMmUtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMmUtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzM2MtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzM2MtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzNGYtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzOGUtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDA1YWItMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JDZiMDQyMGJkLTY5NDItNDlhZC04NmQzLWRhM2IyZTc4MGMyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTGFuZ3VhZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTG9ja2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuVHJheUhlaWdodA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuVHJheUxhcmdlSWNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yNi5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5XCouZGI=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8i","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcRG93bmxvYWRIZWxwZXJUcmF5XCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxtc2NvcmVlaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Jmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KV03MV1EQV1iUV1iWV1iYV1iaV1icV1ieV1i","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KikrKSwpLSkuKS8pMCk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"K0hlbHBzIHRvIGRvd25sb2FkIHVwZGF0ZXMgZm9yIHRoZSBtYWluIGFwcC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LH1FXU40Rm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2NhL2dzdHNhY2FzaGEzODRnNDBD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC43LjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MDkwMzE4MTAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vY2EvZ3N0c2FjYXNoYTM4NGc0LmNybDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MSwiZnVzaW9uIiwiR0FDIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"$3e","type":"Ansi","source":"File String Dumps","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"$3f","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MSwiV2luUlQiLCJOb3RBcHAiLDE=","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjEuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuMC4wLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuOC4xLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYwNjE1MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTgwNjIwMDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTkwMjIwMDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MiwiQWNjZXNzaWJpbGl0eSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDA=","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLldpbmRvd3MuRm9ybXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5Iiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MjAwNzE1MDkyMzA0Wg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjAyMzAxMTIxMjI5MzdaMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjIwNDA2MDc0NDEyWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjMwNzE2MDkyMzA0WjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjQwNjE1MDAwMDAwWjBuMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjkwMzE4MTAwMDAwWjBMMSAw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Mmh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc2V4dGVuZGNvZGVzaWduc2hhMmczMFU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIiVXSU5ESVIlXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbVwyYzNjOTEyZWE4ZjA1OGY5ZDA0YzQ2NTAxMjhmZWIzZlxTeXN0ZW0ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvbmZpZ3VyYXRpb24sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvcmUsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCIlV0lORElSJVxhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV8zMlxTeXN0ZW0uWG1sXDE1YWYxNmQzNzNjZjA1MjhjYjc0ZmM3M2QzNjVmZGJmXFN5c3RlbS5YbWwubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MzE5ZGM0NDktYWRhNS01MGY3LTQyOGUtOTU3ZGI2NzkxNjY4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzMwNTA4MDc0NDEyWjBTMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MzQxMjEwMDAwMDAwWjBbMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"M1N5c3RlbS5SZXNvdXJjZXMuVG9vbHMuU3Ryb25nbHlUeXBlZFJlc291cmNlQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NDh0eE8xdzllZUd4RGxpRzBPLjJ3Mkc4bk0wSDl1MkRBNHY2NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NleHRlbmRjb2Rlc2lnbnNoYTJnMy5jcmww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NTxCPWEvbVg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NzYzZmQ3NTQtNzA4Ni00ZGZlLTk1ZWItYzAxYTQ2ZmFmNGNh","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2h0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzdHNhY2FzaGEzODRnNC5jcnQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"OGU5ZjUwOTAtMmQ3NS00ZDAzLThhODEtZTVhZmJmODVkYWYx","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"O0dsb2JhbFNpZ24gRXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlU2lnbmluZyBDQSAtIFNIQTI1NiAtIEcz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"O0dsb2JhbFNpZ24gRXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlU2lnbmluZyBDQSAtIFNIQTI1NiAtIEczMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MxMDRfMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MxMF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M3OF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M4OF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M5NF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT57MzU5MEFDRDUtMkMxNC00REE2LTk3OTItREJDMzE3MjNCNDU0fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+ezY3MDdFNjIyLTZBODUtNDg4Ri1BRTMxLUIxN0ZFQTZEMkI5OH0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"P19jPjlfXzBfP19fX3QzX19fX19fX21lOWVfTGxfPz9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"XyIiIl8/IiIi","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yNTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT00MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT02NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YTY2OTAyMWMtYzQ1MC00NjA5LWEwMzUtNWFmNTlhZjRkZjE4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QTdsNHNlWnowWk54bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YTpjfDkjeW10","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWNKSzRqSHZvWHYxakc3YW1LTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0VsYXBzZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Zvcm1DbG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nob3du","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1dpbmRvd0V2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWludXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2Vjb25kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YUVuNTJWZEExa21jWjZ4djM4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YUVuQzUyVkEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWlNVTZoeERHbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWowcTFPeEw3NUdlQThJQjMz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dBbGxVcmlFbmNvZGluZ0V4cGFuc2lvbg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEYW5nZXJvdXNVbmljb2RlRGVjb21wb3NpdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW0wMHM1V2pN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YW44WGFZQkowWXhSdlAwMHlLRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW5zaUN1cnJlbmN5U3ltYm9sbmFuU3ltYm9s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QU9FWmF4N1pwSVVoV3lhS2tZaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVA1cXI0VFNjNUxYdng4bWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25TZXR0aW5nc0Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVBTOEpNeGJrcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXFGOEJHdFRpVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVFLVVVxTEtwTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVIzbmJmOGRRcDJmZUxtazMxLmxTZmdBcGF0a2R4c1ZjR2Nya3RvRmQucmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVJSQjVRNnA3Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YXJVQldJTkVZag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVNDSUlFbmNvZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1NjYWxlTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVhOWHRnd3B2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVk1SHg5SHFFUDU0WHZDcnZMTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVo3TVZEbnBQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QjBOSDlCN3IzWVR5UXdITXQ0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QkE0VXZORlZNRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkFFdnJkaGVXeUp4VlYxUnVE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkFFeHZyZGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmJka2pLcVVBMVU5WXhuVUxPWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkJtdUhGcW9YMzJId2ZGdWlRYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmRMWkR2N3hpQTRIallKVHBVcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkRxYkg1N0hDanhYM1lRRzVwNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5JbnZva2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QkVQV1RWQkNna1VQTDdIaEJTYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmZxdDJaSG9SU3JBNXVVajBVUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Qmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZXh0ZW5kY29kZXNpZ25zaGEyZzNvY3NwLmNydDA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmliM1dkNzAwdGJmQm12ZWljOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5UmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkluaGVyaXRIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkoyZkJXN3ZJN0w4R012Z0ZVbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmpsRldKN0Q4WGllTVdKeVlwOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmpVYWVFSDdCOTZvZWRUQk9RYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Ymt4WmN2RVp2Slh5WmNmbWlL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Ym5QZndiQnNhNmRkT09LTWVmYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlBjVURzdUVVNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QnBHVXB4QlFXRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YlFlYnFEcTl5VDhDUGlWRVIyVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QnFueTBEcUJnSW1zRHVHclZCQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlNwV1E5ZXRERUVZMHZHTUYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlRzbnZQQm5rOUkwYlZYWGZKcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlYzN0dDQkxiZDJxeXNvcGc4TQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2FsZW5kYXJtX2RhdGFJdGVtY3VsdHVyZUlE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGluZ0NvbnZlbnRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0Y2hOZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y0JGUlhObXRnd3B2Rm0wczVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2MyYmNiYmEtMTZiNi00Y2YzLTg5OTAtZDc0YzJlOGFmNTAw","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2ZhTzJwdkR0Rmg1RERuWEVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2gzQk95bjlocg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2lwaGVyTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhc3N0aGlz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50Q2FjaGVTaXpl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xOODgyaW9rSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y0xwOXNRN2hSTTFXWmlqaFJMWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q0xSTG9hZExvZ0Rpcg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q04yZWhkNzRHSzY4THJNREFQYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZUV4Y2hhbmdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcG9uZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbmVyQ29udHJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbnNLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29va2llRGVjcnlwdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1FIMlJMQVNIQTZmQXFzZUxh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1IwOEZLUnNtTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JZNHNlWlowMEQ0bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3RaN2syQlVFR1g4dkl2NkRVMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VsdHVyZW1fU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lEZWNpbWFsRGlnaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lEZWNpbWFsU2VwYXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lHcm91cFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lHcm91cFNpemVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lOZWdhdGl2ZVBhdHRlcm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lQb3NpdGl2ZVBhdHRlcm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lTeW1ib2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudFVzZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VzdG9tQ3VsdHVyZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1ZEUlNMYTVQRFRKSmI4S1FK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q1hnQkYydlJCZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RDFROFZlTHEzdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RDZ3Qm1KVEJFMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGF0ZVRpbWVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGF1YXZ4N1NiaVozUzU1ZUgyUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb21tYW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb25uZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJEYXRhUmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJnSklURGVidWdMYXVuY2hTZXR0aW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJnTWFuYWdlZERlYnVnZ2Vy","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJZVUNTSGZFVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZENsQlRTMm5QUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGNPOGVhb2djZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZEQ4UGE0WG5EZnRic2ZrTHQz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGRJQjAycTRwUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXIgRGV0ZWN0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXJOb25Vc2VyQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGVmYXVsdEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVGWExIcTAzQXJxQ1JkTzhzQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGVnZUpMV1Bh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlclNoZWxsSG9va1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzZXJpYWxpemVPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGV2T3ZlcnJpZGVFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGdJY1J0SjVDaDB1SENEUTNt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZEgyM1JMU0hB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGljdGlvbmFyeWAy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGlnaXRTdWJzdGl0dXRpb25pc1JlYWRPbmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNvbmZpZ0NhY2hl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1TSVBlZWs=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGtJQk5VWjFkVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGt5JyEmenw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RE1seUpPN1JhWjdBQk55aXNMTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZG53VTRjbFlVT1M4VlZoWmRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG9ja1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZG9uZjVQS2c0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRDYWNoZVF1b3RhSW5LQg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LmcucmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXMuUmVzb3VyY2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXMuUmVzb3VyY2VzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZFA2TFp2SEluTXhBdkRncEF2bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RHEzclNJN1FHZ2kzb1Y4N0RSWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHJyRVUzVmhFbWNuS0tLS0VR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RFRhQnFBTEQwZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHdEZXNpcmVkQWNjZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHdQcm9jZXNzSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHgxOGt2cW1HQUJnTkhlMnM4UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RHluYW1pY01ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHl1Qnh0Qm9oQVp5eGhZV0xaVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZTA5VU9rUG14bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZTEzYzBkMjMtY2NiYy00ZTEyLTkzMWItZDljYzJlZWUyN2U0","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZTVyOG9wUjBsZ2JRN1RZMmxy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RUN1MVVxR1dLUnVHUEpqZUJD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZWdkQkdyTExKOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWdsMGpON2xhaGdPREE4UkV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZWlndFhsSEhhREU5czFwVWZENw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50SGFuZGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW1iQlhEZUZDOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTG9n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVmlzdWFsU3R5bGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5kSW52b2tl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5kc1dpdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNoaWxkV2luZG93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRocmVhZFdpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZU8xYXgxN0V3SjRtdXZlN2pGTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZU9YQllNcHU2UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RU9ZQkV0cUdqQk45RHFlRWZobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZVBmVHNhY1lTUnM5QkJqeDBS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZVFkOHAyd0FEbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXNERlhxMDBReE95VWNqaUhU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZXNLQmloRnN0Tg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRBcmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVZsalRkNzlHZHlmdW5DUGJVYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZXhiR2doNWxtQnNuTnlwdHZ2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZVJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RVplMUxBcGNxSjU2WWlVM2RT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkFuS2kzcURHYzdNanhqVVViNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkJxQnVOdjRvN29Eb3Q5djZx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkNIQjZraFlXNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkNSUHJHSHVzc25QRTRCVUFv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZVNJTUQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmYzQnlTdW9MUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmZLQlVmSVVZcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkhTa2RBbmtKZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmllbGRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmlLdFhsUjJx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFjY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlTWlsbGlzZWNvbmRzQmV0d2VlblJldHJpZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlUmV0cnlBdHRlbXB0cw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVNoYXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmpwOGg3azFEZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rms1QnVvODJlOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkwxSGNtcTJ2c1NCSTZUcURsVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmxhZ3NBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxBbGxvY2F0aW9uVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxNdUQ2cUVCcTIxS2ZKM3MyNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxOZXdQcm90ZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxQcm90ZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaW5hbEJsb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm1SOFVISFZ0Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Zm8yQW5JQnVCYmRPWnJxSHB2dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUludFB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RlMyS2JQcWR4VVJoZlhZRFdqVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZlN5c3RlbS5EcmF3aW5nLkljb24sIFN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYWpTeXN0ZW0uQ29kZURvbS5NZW1iZXJBdHRyaWJ1dGVzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5bVN5c3RlbS5HbG9iYWxpemF0aW9uLkN1bHR1cmVJbmZvLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODlmU3lzdGVtLkRyYXdpbmcuU2l6ZSwgU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZnliQkJPODFHSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZllCSGFZckZkYkpzZW5DbnJ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZllVMDRWSG45a0ZzbXFmM0pUNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rlp0OEx2akNQbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Zzh1bGk1QlRBSEtBY3hJWTV4eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R0NIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2NQVVJrQlBNRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGVkQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FsbG93T25seUZpcHNBbGdvcml0aG1z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FwaVVSTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Fzc2VtYmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Jhc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvZGVCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvbnRyb2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlY2xhcmluZ1R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZhY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpZWxkVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhc1Jvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hvdXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQXR0YWNoZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzU3RhdGlj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzVmFsdWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hbmlmZXN0TW9kdWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01heExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01ldGFkYXRhVG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01pbnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vbnRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1BhcmFtZXRlclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2R1Y3ROYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Jlc291cmNlTWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JldHVyblR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlY29uZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RhcmdldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RleHRMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RocmVhZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsRGF5cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VuaWNvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZlcmJvc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1dQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWxsQ2hpbGRIYW5kbGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3JlYXRpb25UaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3J5TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUNocm9tZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUVkZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUZpcmVmb3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhlY3V0aW5nQXNzZW1ibHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmllbGRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0R2VuZXJpY0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SUxHZW5lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdFdyaXRlVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWFuaWZlc3RSZXNvdXJjZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcGVydHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHVibGljS2V5VG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVxdWVzdFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3ViS2V5TmFtZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0VVJM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmFsdWVOYW1lcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2c1VVNFaDdiUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2phVWJrNmFudg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2ptb3FUSFlvblM5UEMzRUs1cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTEpMCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTExMC8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTFEMEI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBSb290IENBIC0gUjMx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBSb290IENBIC0gUjYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsc2lnbiBUU0EgZm9yIEFkdmFuY2VkIC0gRzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsc2lnbiBUU0EgZm9yIEFkdmFuY2VkIC0gRzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R21sRUV2RGtZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z01OS1FIS1l3Q2hrTVB4ak9q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R08yOHlaWDdRUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R296byBSZWdpb24x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z3B3VUpINUVLVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3FVVHF2SFRJUkxXRDVrS3VYUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3JCczNabXVEZThwQmFXdUJ3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3RtNWlCQkZuQzdXSWJUY1lDSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R1dMX0VYU1RZTEU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R1hUOFRrOGJxeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z3lwYzB3cWN4NTBocXNMV1hSWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDRQSFBBVWtyeWE2UUFja1Vs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDRQVUhQQWty","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aDVGZnd5QklCQzJFM0dMWGFrSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aDh4bndocTFTc2N2Q2lyVmhrdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDlVT0JnN3c3cWdXNDVqeG5CdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDl4SkZiY25V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGFyZHdhcmVJRA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaHRhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGVscHMgdG8gZG93bmxvYWQgdXBkYXRlcyBmb3IgdGhlIG1haW4gYXBwLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGV4YWdvbiBBSSBMdGQuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGV4YWdvbiBBSSBMdGQuMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aEZlOFFTVlVVNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGlKc0VJdzk1bEtJTUNrS0h3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SEo1SmhhQjI4bmxkYUtuOElDRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aExad0VCZmFP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SE1LOFpOVFFNdHU3VndFSGo5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SG5hQm9yN2RUdnNnQzRYR3BScw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aE9BVWg5Y1FZRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHBuQmZpdklobw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHJTUnBHN1VITjZkY2NvZkNRYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aFM5aDk1N1g0b2RlQnVpUzhUOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FDQ0VTU0lCSUxJVFlTVEFURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FDVElWQVRFU0hFTExXSU5ET1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FQUENPTU1BTkQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0dFVE1JTlJFQ1Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0xBTkdVQUdF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1JFRFJBVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1RBU0tNQU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0FDVElWQVRFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0NSRUFURUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0RFU1RST1lFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHRtbERlY29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFV0aWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlcXVlc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlc3BvbnNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHUxVXRtYkQ4Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHduZENoaWxkQWZ0ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHduZFBhcmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFdSUG9ydFJldXNlT25Tb2NrZXRCaW5k","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aFdUNHJndVNDZG1rSURZSmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFhkdTNScTVuU251MmJYcFlqbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHlaaTBVenNmU0tMWE93YmNO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTNZVVZacUZjUnNWbzdZVndvWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"STdIWTZlcWFpV1R1ajZOM3IyYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"STdtb0l2QlpjQmIwZ0VLUUFhTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTdSVTI0OEdWVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTlLTVlpZXZYQ1VOOVVEWmky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aUFHOE53c2M5UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUFzeW5jUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNvbnRhaW5lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNyeXB0b1RyYW5zZm9ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aWZ3OVA5cWlRNnRTcTZpNElzSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWlJVVdtTFdabg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aUlsVUVkbHNmcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWxDUWFGQjVKUW5CV05ZQWRlZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUxHZW5lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5kZXgzMjU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbFJvb3Q=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SU9hdm1GN3VIYWlaWWtJMTlwZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SU9yZGVyZWRFbnVtZXJhYmxlYDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JFbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JXaGl0ZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SVNwQVJsSnV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aVlFSEdNbDNs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aVpyQmxUQ0liNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajFOTFpWUVNwUmxKdXh3TFpF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajY3SlRJYUgyYVlucjBaU045","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajhQeDJNcUtZOERHc0pGdk5CQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"akNPNTJYSGxuakpBRFp3OVowdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"akQ4YUZEcVNyRDM2ZmQ2MEJ3UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"amZkTlVacTYwUGZLWmRuVE5RUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"amhGZUthcUhDR25haFYzb0Rvbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ampsOHZqc0Fibk9PRmczQ0k3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SkpzTDJSVDND","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Sk1uQnNlZDhJMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"alNDbmRta0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SnNvbkNvbnZlcnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SlR1S2dwQlFyMEpOSlBnUHJGbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Sng1V1A0N2I2SGdZQ2V3VFpnQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"alhlQmt5dWQ0RA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Slh5cmdlWEF4M0tSQ0dRR3cw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azVNRmN1N1AwdzIyZndoQ3NKVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SzhIQmNGSkZ5UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azhqSnFwSERYU0NWb3ZxSUNSSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azh2YU1RS0hI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2FQbExacUpTa0VlNUVDTE84Tw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2F1VU12SkF5NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a0IyMk9sQld1RmhGeXFpWTJFMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S0IzVVRndnM1Wg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2UyQm5wdDc5dQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2V5VmFsdWVQYWlyYDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2hsUHJucXc4YU1GRlg4VmlQSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S0lEUkRTcWV1TlJva0VMRVZOUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2xSMnFsZVFpSlhHTGRhbXNo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a21lNTNjQjBVYkRLUk80U3FEVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S25YZ0VwQkJG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1BQc0pPTHBz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1MyaXl4N0Jpc0xwQ0xORzJrZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1M1ODhiQmdDQ29LZGxuanZlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1Z3NkVIajlC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1dvYW00Qk8yWVJybkZLQkpXTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1psVTRRcTVkdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDBiakN1MVVx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDBvSGM2N21ZUk9zZGM5SE9Zdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bDRpOFJlNzI5TlZvWU5wZ2I3Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDRsZUN5aVdOdTFZaFZRQkln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bDROMHd3QmtObDZ0QjBuOVdwYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEJ3QlBNWWhxbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bENySTNyQjdKcDVvODF5UmwzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TEN2b0NPMTc0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bERXSnY3N09TVEdRamZTS0hPeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bGRaeTkxN1RCM2ZRZHBTcVEycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5UG9saWN5VGltZVN0YW1w","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEdzOGpkT0JqTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bGhHVVpKZ3RKag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGhubFZaSHc5dnZLQndXaE9iMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEtPa1dadjhY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG1FOElRdjNsQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nRmFpbHVyZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nUmVzb3VyY2VCaW5kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBCYXNlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBmbE9sZFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBOdW1iZXJPZkJ5dGVzV3JpdHRlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBzekNsYXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBzeldpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"THFJVWxqbjRKMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHFuQmhkSE45Q0IyTEwzc1ZDRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFRsN2ZqN0txbkd1WVY1TmlyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"THZKdjA0QnhsM1JuMnFyMUo5MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TFdBX0FMUEhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TFdBX0NPTE9SS0VZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHdKSG5Kd2hQVklJUzZSZXNu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHhmVWpuMmIzUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFlNb3I1cVJLc2d5SVdEWW9xZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFo1bmZISDBSRG5jUXdhV3R5Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bTAzczAwN3lmUXc2VkZkdTROaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTBlTnY1cWZEYUVWRWtFcmpoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTFpVTdrS21KOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bTRwMUNOMTBlcjJ4QlRQSThO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TThEZ3l4cWxZZUlERGx5MWdxMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTlFU3ZHS0ZN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9pc1JlYWRPbmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9pc1JlYWRPbmx5bV9jdWx0dXJlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9saXN0U2VwYXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9uYW1ld2luMzJMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9uRGF0YUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGVtX2lzSW52YXJpYW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGVtX3dpbjMyTGFuZ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bWE2QlFBY2tV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFrZUJ5UmVmVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudEJhc2VPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdFNlYXJjaGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWF0Y2hDb2xsZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWRFVXNkRWxsUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVGMllGNFR5OEhwSFlCVXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUdJQU1YSFZQbnQ3d2szM1hvYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWdPOGJUV3A2cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bWgxQnRTNHRMaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LldpbjMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bUp4YlZWMVJ1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUxuRTQ2Wk9CNGh5TjJCaGx1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TW1zOWhJUk9W","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TW1WOHN5QXRORg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bU9Pbnh3QlYzaUxLMWlGbGVWeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXFtOHF2OW1BUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXJmZG11cVlYcmZPOEZCQkxVUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXNyVXpybzNRbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXRXb2Zab2o2UGI1dmVYS1JH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGljYXN0RGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXdYR0hHN3FIRGk5WEpyTzlSaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bVpFNkNlSGpHdE1VTmNHWVlZMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bjJSNG5hNmQyZzYwZnE0alBT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bjVSbHFSNzdJdXgySVVhTGtyMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZWRQaXBlU2VydmVyU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVZhbHVlQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlRGlnaXRzbV9kYXRhSXRlbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlRW50cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlU2l6ZU9mQ29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmJDOXRPN1Z2d0N0WjlkOWNDRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TkJVVTBFUUhscg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmNCWGtBN2VPSnBMQW93NmRLMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bkNtZFNob3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmRnVG40Q0JNQjZWODNibk9R","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVTaWdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVQQkRsMElHWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya0NyZWRlbnRpYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmV3dG9uc29mdC5Kc29u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmZBaHFzZUxh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmZwdVRWa1JM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmdGOEUzN2VlcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bk1iUWpocVhLN0VhUDdhWVBPVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Tm9DbGllbnRDaGVja3M=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnF3TWRJSW4xaTFlc0lxU2JX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnR0OFBUOEpBWGl4bFlXSnlI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TlViOEFVblQwOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyRGVjaW1hbERpZ2l0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyRGVjaW1hbFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyR3JvdXBTZXBhcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyR3JvdXBTaXplcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyTmVnYXRpdmVQYXR0ZXJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"blVPQko2WDFZeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TlVQU3Z4SHR0NUZkQlRrczR4Tw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnZvOFNHSTA0UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnlqajhVR21iYkpIdjBvVGJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnlwcWZKN2ZEVmg2Skh0VEloWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzM3cE82cU4wRmQwdTFWNHlCQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzNWNjN5N3NYbGtMbVFOZHIzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzVTeVpYN2lUcktmTW9Va29icw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzYzNXdTZDVvaWN0ajFiaVV5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T1wqKV9QcH4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0FjZ2VRNzhlcVEwVktrWDNTYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0SGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0J5VW1pNG1qVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0gxVTVUYnhmRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0lSRjFXN3RaaXFkQ2g2cEY1Qg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b2pmVExiN0dQZ1k5b0hEYnVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T2xmZTNiSHVxY0drM3dGSUp4TA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T01TUTRXUG9I","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T241UEtnUDR5S09XWnY4WGZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b05oZ0dQSFVqcUVTM2c3RFhEYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T25seVVzZUxhdGVzdENMUg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b25uOE0wZWR2TQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T05XQkZwS1VTTFVCZUtNYWxJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T25XaW5kb3dFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfR3JlYXRlclRoYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfSW5lcXVhbGl0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfU3VidHJhY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkJhc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3B0aW1pemVVc2VkQmluYXJpZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b1E4T0pmQnJlWmhnZUNTNnV3cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3JkZXJCeURlc2NlbmRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3JFRW1CQm1nQ2lZRFh4SzVCMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1N4a2dBQndPVFRxRnR5Z2RDRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1RhWVFaQmRGRjdFVVR0VFBxUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T1ZRR3dwcVFJZGh2V2NlWjB1Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1c5clpFY1V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3lBRHhKUzNobGlZU1pxUEVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3lYVXdZTHRqTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UDBwM2tTcUFOaUFBYk04ZEhIbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cDJjOG1oSnB3YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cDVpYVZQNzZFOUQ2SGZaYUtNMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFsbTV5Z2ZSSUFOd2N0TGxi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGRaQnZjVVpCRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGVDT3lXTnUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudERlY2ltYWxEaWdpdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudERlY2ltYWxTZXBhcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudEdyb3VwU2VwYXJhdG9ycGVyY2VudFN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudEdyb3VwU2l6ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudE5lZ2F0aXZlUGF0dGVybg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudFBvc2l0aXZlUGF0dGVybg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGVyZm9ybUxheW91dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyTWlsbGVTeW1ib2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEY1VElscXNGb3VZQWV4U3IzbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEc2ZndncWhQSWxqWDU1a0NTNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEdjOHFadm85","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGdudW9ZRmhTNXEySXJVcUhCLjRJNWE2SlFnR3M2am80eDJkVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEdzODZwQ1NsNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEd1Rkd3cWpCWnNIbjFaQ2RVNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGlwZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cElTVTF2MkxNdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGtxR3J4QlBZdnlLbUZoVkxsQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEwxOEhMa1B5bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UE1iZ1h4QjhOZm9raUwyRzN3QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG5hVHdjUUtkVHkyOVZiMmpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG8wMmk3TTJZaWsxMFd0YnBQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVTaWdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG90WnZWN3BWWE1PMWtuUGpUZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHBEcHRGaDVE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFFpMUpYR0xk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZSBPcmdhbml6YXRpb24x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHJvZ3Jlc3NCYXIxLk1vZGlmaWVycw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydHlJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFQ3QnB4WnZKMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cFVBdkJRN2tFUTZucHIwWktRMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVKOHZTaVlZVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cHZKS1h5WmNm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFdxUGdBM2wxVnI5RXZHS0ZN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFgxdk1RVWpB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTBONTdCMnM5RFhNajBKcDhr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTJJVTlxaHI3OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UTNIVW9pczFGYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTRxVWFnMzhtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UTYzQmVOdFRCeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTdaQnJ3dU5Iag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTltMVhqcW5Od2lhcUNtQmRpTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTlOVXlQY003bA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUF5cE85NzE0NkFqVjdCU0xCRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUJoU0ZzV1dhQ1BIeW0za1R1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWNxWnZvQjlPTVM0V1BvSGxY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWNaRGlWSHJ2TXlPM2JDRmlGeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWVYOG5ndEtQSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUZCYUI1bmYxYnlZTjhoTWRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWlLZVVUN1d4ZmR4WjY0c1JFNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUpBSUVDQnEyNlJsMGRXYWl1dw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWp2QlptdllxYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUtSNXVHUEpq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUxRQm9aRlpsTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cU1ZVUJjRzhsVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cU4zWEdyRTFrRjRPQUhmTkZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UU5hVTMxdUxPUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UU5JNjA5RlBrWDlxU1RGbVlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVBhbkpzeTJSVDNDWXMzMHNoYDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UXFLVWJPcVdzUzc4R0JVS3huMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UXFQTmdBbDFW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cXRsVUc1cW5haw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVRzaXhmeUY2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cXR1OGlLcXZBOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjJqdHUza0I4Q1NSWmlaSWFY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjQ0OHVpZHN1Ug==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjRDa2ZsQkE3MVJaRksyYTVUNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjRIVXJxbHhBWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjR4VWttNzFXeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjdoODQ3SEVpTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjgyVWVzS1lNaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjh5WkJmVmI3YUpzTWVoTjRQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmFFVHAxTkxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZE9ubHlDb2xsZWN0aW9uQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFRvRW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnZXhPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGVsbEhvb2tXaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlIaXZl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWaWV3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmVtb3ZlX1dpbmRvd0V2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVxdWlyZUNlcnRpZmljYXRlRUtVcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZU1ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VNYW5hZ2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdW1lTGF5b3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UkZPR09pNzVsVGtOcWE4dldBTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmdRQkFlOTNHSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cmgycnIyRFRyVmdKNkJSdXQz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmlqbmRhZWxNYW5hZ2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cmpqOGROcGFvTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Um5HbTFscXJaNnNIS2Q1VDhLUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cm5TeGZnQjFYMmd0WGpOT01Law==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ck9lQktHa29lSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cnAwemFDd0hC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cnRneU91cExTTlBIMVNkMUl3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUZpZWxkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUhlbHBlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZVR5cGVIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UlZPUHUwN0FYa3hEQTE3NFZldQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Und3WmpIQmV5R1dJWXhKaWptQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UzFlVURXcU84TVhrcVlieUZPOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UzFKVU55eFU2NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2FCQkl0MDNoZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c0FjaUMxQk5aTnRFSTlVbkhEaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2FkTm1oeDdtNXhONGxBY3ha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FKQnpTOERZVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2NoU2VuZEF1eFJlY29yZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NoVXNlU3Ryb25nQ3J5cHRv","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NQeTROcXFZMUdycURTaGxhNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsQmFycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsVG9DYXJldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2RLOEdCRzBFTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlQcm90b2NvbFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2VuZERhdGFUb1NlcnZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZVBvaW50TWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FwaVVSTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0F1dG9TY2FsZURpbWVuc2lvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0F1dG9TY2FsZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NsaWVudFNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbnRlbnRMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbnRlbnRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0RvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0V4cGVjdDEwMENvbnRpbnVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0lzQmFja2dyb3VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0xvZ0M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X01ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X011bHRpbGluZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X09wYWNpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Njcm9sbEJhcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlY3VyaXR5UHJvdG9jb2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlbGVjdGlvblN0YXJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Nob3dJblRhc2tiYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1RhYkluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZU1hY2hpbmVLZXlTdG9yZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZXJBZ2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1ZlcmJvc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Zpc2libGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29tcGF0aWJsZVRleHRSZW5kZXJpbmdEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGF5ZXJlZFdpbmRvd0F0dHJpYnV0ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0dGluZ3NCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2Y3eTNJQktScDRjMmFuTWJVWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2dSSURVdUlBRXRqQkxtSks2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFdmVudHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hWbFFCSWcz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lsZW50QnJvd3NlckZvcm1z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lsZW50QnJvd3NlckZvcm1zLkZvcm0xLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lXOGc1QmZuOHdUWmRqVmswVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0phRHlJSDhF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0pSOFpqUjhTQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c0p0VHA3OTJyT1RuUHcwNlVh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0w0OFBxWjRBRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c043dWlJcUlERk1OWmdHSm9kWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c284V0hTQkpjeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U29ydGVkTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29ubmVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlRGF0YVJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1NEVWNUTUJScw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c1NSQk1qUGlBRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRzV2l0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1RBVGhyZWFkQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nU3BsaXRPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3VzcGVuZExheW91dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1VzU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkNoYXJTZXQsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c1ZFRnNwN3pManRYaDNnN0FDRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c3ZnTWJOcVpLOHFTdHVhdE1GeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c3ZNMHdBUEcwZ3hpd3ROZUJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3hQQjJQZHhBTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3luY2hyb25pemVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvZGVEb20uQ29tcGlsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLlNwZWNpYWxpemVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbXBvbmVudE1vZGVs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmUsIFZlcnNpb249My41LjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":1,"total":90},{"value":"U3lzdGVtLkRhdGEuQ29tbW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRhdGEuU1FMaXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ2FsZW5kYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8lU3lzdGVtLkdsb2JhbGl6YXRpb24uTnVtYmVyRm9ybWF0SW5mbydTeXN0ZW0uR2xvYmFsaXphdGlvbi5EYXRlVGltZUZvcm1hdEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"U3lzdGVtLklPLlBpcGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk1hbmFnZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":90},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24uRW1pdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuUmVtb3Rpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":1,"total":95},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNDcnlwdG9TZXJ2aWNlUHJvdmlkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQuUmVndWxhckV4cHJlc3Npb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZy5UYXNrcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRpbWVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldlYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRGVmYXVsdFRsc1ZlcnNpb25z","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUHJvY2Vzc0hvb2tGb3Jt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1p2dWdQZzJUc3hmeUY2ZFhv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1p2dWdQZzJUc3hmeUY2ZFhvLlRwVFZrUnBMUlo3VkRucFBlUSt0QXA5Sm0wbEV2RGtZUWVnSkwrUVBhbkpzeTJSVDNDWXMzMHNoYDFbW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dW10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDBIQlNvR29raQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDBtMEZsaFUwQ0Q1bEExeWdD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDBNYWJVV2d5WEwwQ1ZsYUxy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDNKOHdwOGs3NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDQ4V1ozcUxzVGdPSm81Z0JiMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDVtUjVHVGl3SFJwWjc0Zm5K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDdJdEJaaXJKeWlESjVEa0Iw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDhVV2VON1lRSlc1aWpKV1RpNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDlPQlZnc3haZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VD4pOTpHN3U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dEFwOUptMGxFdkRrWVFlZ0pM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGFza0ZhY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGR3RjRXcVY2eE1NY1VMR2pGRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGVnRzdONUNT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dEJveEJhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGZMN2ZabllD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGZ5Qmg2MXAzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGdVVXFMVm1OVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dEhiQjNyWVd5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGhvOG9jYjlVWEZPcnFNU1Uw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkU3RhcnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGltZVNwYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VElYOUhLcXhGWW1kSmNVcXVnZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGtkU1RmQmN3TWR1bW1Nazh1Tg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VEtrTVc2QlI4MlN0QWFKTjkybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VEtzdkZ2cmwwZ2oyOUtPZllX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG1DOFg2OG0wUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dG5EZGZ0YnNm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG5PQkhLUnJhOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VE5yTkt2cTdnUWZib2o3QTlLNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9CY2t4WmN2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9Cb29sZWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9Mb2NhbFRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9TdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9VcHBlckludmFyaWFudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VFBucmg4N0xzS0k5cVBkMXJmNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHBUVmtScExSWjdWRG5wUGVR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHMzcTBzaEV1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHNwODBzdkhrNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHRLcXY2Zkh5MmVDb0t1Y3Z5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHVybk9mZlNQSUFuaW1hdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHZUQkwxeUdxNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VFhGQndacVZnUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTBxTmY5T21OcDZaNGVRWmw0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTFZVUtpc0Q5Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VTNuVWY2Y2JXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTVDQkNNN3Q0UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTdFUDl0RXFPaVFZWTA4SHR3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUE3QlFMd0pRcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUJMdkc4N2pqbkxJdUROdzhPNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VWQxd3MxTFNVeVVDMFFBSzBT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dUVnS0xwQlk2VGRXZFpWQnNvNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VWdRQmE3Nkh1Rg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dUg4RWZmTUxmWm5ZQ2hXOVpF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dWhHODVJSU4zZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUx0UDM0QXA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VW1jWVo2eHYz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VW5tYW5hZ2VkRnVuY3Rpb25Qb2ludGVyQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXBsb2FkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVFRVThsS29rRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVF3OHhpRDdJSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VVJCQjdnYUJDZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXJsRGVjb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVJPVk1wTDBhQ3dIQmpjUGtC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXMwVXVwRUEwbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXNlSHR0cFBpcGVsaW5pbmdBbmRCdWZmZXJQb29saW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlTGVnYWN5SWRlbnRpdHlGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlTGVnYWN5VjJSdW50aW1lQWN0aXZhdGlvblBvbGljeURlZmF1bHRWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLkRMTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXNlU2FmZVN5bmNocm9ub3VzQ2xvc2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU3RyaWN0SVB2NkFkZHJlc3NQYXJzaW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU3RyaWN0UmZjSW50ZXJpbVJlc3BvbnNlSGFuZGxpbmc=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVRXTlFWQmpFbTYzY09RUVg4SA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVVMVVE5WFEzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVVwY3ZxWU1adnhUckRXakF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVdFQng5eFdyMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dXdKY3k3NzNxMVhHdW5DZXBDTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjNGOFJFd2NKUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"djQuMC4zMDMxOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"djQ3YzFNN0ZjaGZLTFhDTWJyag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjRyOWNCQk1ReWxiZ3ZWUUY3dw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjVQbFZUQnloWDlpSnlEOEZ2Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dmFsaWRGb3JQYXJzZUFzQ3VycmVuY3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dmFsaWRGb3JQYXJzZUFzTnVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmFsdWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmNxTFFKQnp4N1FLU1FHRlRIZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dkQ0M0l0cXAzM3ZTTXZJckdPQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VkQ1Rkp5VDIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmVVcDhzcXZSOXdtUFdIbFRZRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Vmdjam5mN0pQakdjU0FSTXB2Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VkhRVUZxYXR2VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmljdG9yaWEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlBBZFc5cTNMVDJqUVBjZVJ3Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlJsYlJ0NVF5SVcycWN4WmR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlNUZ3dmQlhWZ0lKNjZuWHF5Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VnRuYkx4UVY0NVVvYnZ0a25r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlVibXVtQkhyMU5ITjlQSURvaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlV0WDh2NE1RS0hIN0N2Q08x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dnZoVVZsQkI4Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlZZTlBidVlZNGdhQlhVSFdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dngzWDhsQmJJZFlYcGFsTjFwZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlhvSVFEOFBh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlpuQjQ2SDVxbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzBXTDhrSEJHSW9HTDFxYTZ2bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dzFWSlhOQjRXalhSZXRKUWtKYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzI2ZTQycXo0T2xBNU9QdmVNag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzZNd1Z0cWI4RHdKclVMeHZaVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzhEVWluVzFRdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dzhFQlIxQnExYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzhaeU5RTXR1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvckNvbm5lY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViSGVhZGVyQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViUmVxdWVzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViUmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0dvTEtmQjlwUEdHMzVQdWxzVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0g2cXdndE51cGRxanB0QVF1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2hsREtzN01iUEx5aVBsR05nWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d2hZNHNlWnVZT2NxZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93RXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93SGFuZGxlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0Zvcm1zUGFya2luZ1dpbmRvdw==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0lXNWhJQkJLRmk3RXJSd1ozSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0o3R2Q2cTgxV25KTXYzM1NYaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0p4aUZTSFhyMEhVb3BXMTJ4bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0s2aWd0b05iZWNjU2pSZWxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0x2RHdwcXQ1bUJDeU1KZXZiVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V05vQmJCdnU5NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V29SVW5JWXZZTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1BKT0xwWnNqOXhGYmNuVXIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3F2b1lpSDkwbG12TlR0eXl0UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVMaW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfTEFZRVJFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfTk9BQ1RJVkFURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfVFJBTlNQQVJFTlQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1NYeTliSEFxWkdrNnJwNVM0Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1RlVlNHQmkxZFNlclhQT0FjTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3RHMHlKQkRNNWY0T0NSbmJZNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1RVVUlPQ0NEYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1djWE9USWZRM2IxamRtc0dh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3hUS0VucTRlV05pTk5OeHF1NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1lXcGhycVBrOW1rWTdKWHFmSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3l3VWdvZEJzWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WDBHV1FocWc4M2E5MjBCSWVPOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WDR5MmFSSGRBMmV5SkpUczZ5cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGE5RERkN2d2b09GakZxSUU0bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEJDVndXVDRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGJvYzJ2N05rbUxyV0t2aUllNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eENBVVlTZWVQag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEVQQmdPbmMyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGVzV0lxU2JX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGZkQjhUVUx4bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEZVUzNGTmd3ZHNRZVZseHNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGhjbUlZYUhS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGw5Uk5yWTFQZ2NUMFRwMmxj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WE1RVWpBOGVoY0lZYUhSQ2FF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eG5qWDVPQjZuTVRBVGMxVUZrbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WG9wc0hDQnZLV0RGeFByTkFzUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eFFZNFp2dWdQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHNiZ1pJQnlNeG93bGducnh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eHVjRDVKNnlUMjJ3WUVHTWwz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHZXQjFYSG1uSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHlieVlvcUMzbmt1NThPNnhoWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eTFCOVF4cWs5RWRLVGoycHhBbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WTJ3OXFnYjA5VGpJQ3JFWThU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eTVJQjk4M2daag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUJsbXBGN2FTcG5WU2xUUDUwdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWNFU3FBcXlibkhldTdTVENoWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWNQdGQ2eVNDbkJhT1hQbWI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUNRVVh3OFVrbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWdtNktLQmxxa1lQVUZodHNNRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eWd4TVRHVU5SUU1PamhGRXZS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eUhoSUFkQnRJTDM1SEdxSVJqZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUlDUWcyN25EZUxaTGpvV2xvUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eWtvc0xJcXVJM2FmNm5LYVZVNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWxtVWRiQjNyYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU0zOGdpOWZubw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU04aVJoSDRvaEtVY0pxVkNpVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU1MRTl0N2Nzd29CSkJZVjkwdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eVBkOTVLY2xnRm9GSlBlOTFH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eXBIV05HQzZBaUVXVGRZaE42","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WVFZVVBObjRwVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WVJKODMyT0FscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eXJsNG1MTmZqcXh3a3JZQWoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WXJ4SlFWQWFiOGJsUGIyNnRa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WXQweUVhSEN5OE5DUk85QTA5NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejBQSFZicU1yOUJvWUdTOGZrcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejZvODI2QnB0NWx0ckFXb1NRNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejZXVUFRSWVIYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejcwM3B3cVRJOFpTOGdtYWl5aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejdYQmo4YWNDaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"emY5RlBTMERCQUdTWWR4eElh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ekc0QmR3dW5MaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"em54eXBmSFF2SnhKSmxUSDJBeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"elNEbmg1M3dCa09nMlA5ZnR2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"endNMmRJbjFp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"enhhWXFld04xZmVnN041Q1Nh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"enhhWllxZU4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTEwMDA5LTExMTEyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAwfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjYwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JDZiMDQyMGJkLTY5NDItNDlhZC04NmQzLWRhM2IyZTc4MGMyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yNi5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5XCouZGI=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8i","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcRG93bmxvYWRIZWxwZXJUcmF5XCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxtc2NvcmVlaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Jmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KV03MV1EQV1iUV1iWV1iYV1iaV1icV1ieV1i","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KikrKSwpLSkuKS8pMCk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2NhL2dzdHNhY2FzaGEzODRnNDBD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC43LjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vY2EvZ3N0c2FjYXNoYTM4NGc0LmNybDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"$40","type":"Ansi","source":"File String Dumps","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"$41","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjEuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuMC4wLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuOC4xLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MiwiQWNjZXNzaWJpbGl0eSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDA=","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLldpbmRvd3MuRm9ybXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5Iiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"Mmh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc2V4dGVuZGNvZGVzaWduc2hhMmczMFU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIiVXSU5ESVIlXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbVwyYzNjOTEyZWE4ZjA1OGY5ZDA0YzQ2NTAxMjhmZWIzZlxTeXN0ZW0ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvbmZpZ3VyYXRpb24sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvcmUsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCIlV0lORElSJVxhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV8zMlxTeXN0ZW0uWG1sXDE1YWYxNmQzNzNjZjA1MjhjYjc0ZmM3M2QzNjVmZGJmXFN5c3RlbS5YbWwubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MzE5ZGM0NDktYWRhNS01MGY3LTQyOGUtOTU3ZGI2NzkxNjY4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NleHRlbmRjb2Rlc2lnbnNoYTJnMy5jcmww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NzYzZmQ3NTQtNzA4Ni00ZGZlLTk1ZWItYzAxYTQ2ZmFmNGNh","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2h0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzdHNhY2FzaGEzODRnNC5jcnQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"OGU5ZjUwOTAtMmQ3NS00ZDAzLThhODEtZTVhZmJmODVkYWYx","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT57MzU5MEFDRDUtMkMxNC00REE2LTk3OTItREJDMzE3MjNCNDU0fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+ezY3MDdFNjIyLTZBODUtNDg4Ri1BRTMxLUIxN0ZFQTZEMkI5OH0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YTY2OTAyMWMtYzQ1MC00NjA5LWEwMzUtNWFmNTlhZjRkZjE4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEYW5nZXJvdXNVbmljb2RlRGVjb21wb3NpdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Qmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZXh0ZW5kY29kZXNpZ25zaGEyZzNvY3NwLmNydDA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5UmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkluaGVyaXRIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2MyYmNiYmEtMTZiNi00Y2YzLTg5OTAtZDc0YzJlOGFmNTAw","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZUV4Y2hhbmdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcG9uZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbnNLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VsdHVyZW1fU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0ZVRpbWVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb21tYW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb25uZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGVmYXVsdEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlclNoZWxsSG9va1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1TSVBlZWs=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHdQcm9jZXNzSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZTEzYzBkMjMtY2NiYy00ZTEyLTkzMWItZDljYzJlZWUyN2U0","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RWdsMGpON2xhaGdPREE4UkV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVmlzdWFsU3R5bGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNoaWxkV2luZG93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRocmVhZFdpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRBcmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZVJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmllbGRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZlN5c3RlbS5EcmF3aW5nLkljb24sIFN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYWpTeXN0ZW0uQ29kZURvbS5NZW1iZXJBdHRyaWJ1dGVzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5bVN5c3RlbS5HbG9iYWxpemF0aW9uLkN1bHR1cmVJbmZvLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODlmU3lzdGVtLkRyYXdpbmcuU2l6ZSwgU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZllCSGFZckZkYkpzZW5DbnJ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FsbG93T25seUZpcHNBbGdvcml0aG1z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FwaVVSTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Fzc2VtYmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Jhc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvZGVCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvbnRyb2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlY2xhcmluZ1R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZhY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpZWxkVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhc1Jvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hvdXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQXR0YWNoZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzU3RhdGlj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzVmFsdWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hbmlmZXN0TW9kdWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01heExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01ldGFkYXRhVG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01pbnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vbnRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1BhcmFtZXRlclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2R1Y3ROYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Jlc291cmNlTWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JldHVyblR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlY29uZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RhcmdldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RleHRMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RocmVhZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsRGF5cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VuaWNvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZlcmJvc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1dQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWxsQ2hpbGRIYW5kbGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3JlYXRpb25UaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3J5TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUNocm9tZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUVkZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUZpcmVmb3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhlY3V0aW5nQXNzZW1ibHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmllbGRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0R2VuZXJpY0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SUxHZW5lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdFdyaXRlVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWFuaWZlc3RSZXNvdXJjZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcGVydHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHVibGljS2V5VG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVxdWVzdFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3ViS2V5TmFtZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0VVJM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmFsdWVOYW1lcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R296byBSZWdpb24x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGlKc0VJdzk1bEtJTUNrS0h3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FQUENPTU1BTkQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0dFVE1JTlJFQ1Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFV0aWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlcXVlc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlc3BvbnNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFdSUG9ydFJldXNlT25Tb2NrZXRCaW5k","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbFJvb3Q=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2V5VmFsdWVQYWlyYDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nRmFpbHVyZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nUmVzb3VyY2VCaW5kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBCYXNlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TFdBX0NPTE9SS0VZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZWRQaXBlU2VydmVyU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bkNtZFNob3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmV3dG9uc29mdC5Kc29u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkJhc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3B0aW1pemVVc2VkQmluYXJpZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGlwZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cElTVTF2MkxNdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydHlJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnZXhPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGVsbEhvb2tXaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlIaXZl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWaWV3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmlqbmRhZWxNYW5hZ2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsQmFycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsVG9DYXJldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZVBvaW50TWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Njcm9sbEJhcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1RhYkluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZU1hY2hpbmVLZXlTdG9yZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29tcGF0aWJsZVRleHRSZW5kZXJpbmdEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29ubmVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1VzU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkNoYXJTZXQsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvZGVEb20uQ29tcGlsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbXBvbmVudE1vZGVs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmUsIFZlcnNpb249My41LjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRhdGEuQ29tbW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8lU3lzdGVtLkdsb2JhbGl6YXRpb24uTnVtYmVyRm9ybWF0SW5mbydTeXN0ZW0uR2xvYmFsaXphdGlvbi5EYXRlVGltZUZvcm1hdEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklPLlBpcGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNDcnlwdG9TZXJ2aWNlUHJvdmlkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQuUmVndWxhckV4cHJlc3Npb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRGVmYXVsdFRsc1ZlcnNpb25z","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUHJvY2Vzc0hvb2tGb3Jt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9Mb2NhbFRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dUVnS0xwQlk2VGRXZFpWQnNvNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXNlSHR0cFBpcGVsaW5pbmdBbmRCdWZmZXJQb29saW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU3RyaWN0SVB2NkFkZHJlc3NQYXJzaW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvckNvbm5lY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93SGFuZGxlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0Zvcm1zUGFya2luZ1dpbmRvdw==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTEwMDA5LTExMTEyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAwfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"DownloadHelperTray","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"Imh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjYwNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMTYtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMmUtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzMmUtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzM2MtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzM2MtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzNGYtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAzOGUtMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDA1YWItMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JDZiMDQyMGJkLTY5NDItNDlhZC04NmQzLWRhM2IyZTc4MGMyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTGFuZ3VhZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTG9ja2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuVHJheUhlaWdodA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuVHJheUxhcmdlSWNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yMy5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC1yNi5jcmwwRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8i","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Jmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KV03MV1EQV1iUV1iWV1iYV1iaV1icV1ieV1i","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"KikrKSwpLSkuKS8pMCk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"K0hlbHBzIHRvIGRvd25sb2FkIHVwZGF0ZXMgZm9yIHRoZSBtYWluIGFwcC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LH1FXU40Rm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2NhL2dzdHNhY2FzaGEzODRnNDBD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC43LjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MDkwMzE4MTAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vY2EvZ3N0c2FjYXNoYTM4NGc0LmNybDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjEuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuMC4wLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYuOC4xLjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTYwNjE1MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTgwNjIwMDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MTkwMjIwMDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjAwNzE1MDkyMzA0Wg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjAyMzAxMTIxMjI5MzdaMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjIwNDA2MDc0NDEyWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjMwNzE2MDkyMzA0WjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjQwNjE1MDAwMDAwWjBuMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MjkwMzE4MTAwMDAwWjBMMSAw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Mmh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc2V4dGVuZGNvZGVzaWduc2hhMmczMFU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MzMwNTA4MDc0NDEyWjBTMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"MzQxMjEwMDAwMDAwWjBbMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"M1N5c3RlbS5SZXNvdXJjZXMuVG9vbHMuU3Ryb25nbHlUeXBlZFJlc291cmNlQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NDh0eE8xdzllZUd4RGxpRzBPLjJ3Mkc4bk0wSDl1MkRBNHY2NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NleHRlbmRjb2Rlc2lnbnNoYTJnMy5jcmww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"NTxCPWEvbVg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"N2h0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzdHNhY2FzaGEzODRnNC5jcnQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"O0dsb2JhbFNpZ24gRXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlU2lnbmluZyBDQSAtIFNIQTI1NiAtIEcz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"O0dsb2JhbFNpZ24gRXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlU2lnbmluZyBDQSAtIFNIQTI1NiAtIEczMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MxMDRfMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MxMF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M3OF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M4OF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3M5NF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT57MzU5MEFDRDUtMkMxNC00REE2LTk3OTItREJDMzE3MjNCNDU0fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+ezY3MDdFNjIyLTZBODUtNDg4Ri1BRTMxLUIxN0ZFQTZEMkI5OH0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yNTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT00MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT02NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QTdsNHNlWnowWk54bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YTpjfDkjeW10","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWNKSzRqSHZvWHYxakc3YW1LTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0VsYXBzZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Zvcm1DbG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nob3du","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1dpbmRvd0V2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWludXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2Vjb25kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YUVuNTJWZEExa21jWjZ4djM4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YUVuQzUyVkEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWlNVTZoeERHbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YWowcTFPeEw3NUdlQThJQjMz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QW0wMHM1V2pN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YW44WGFZQkowWXhSdlAwMHlLRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YW5zaUN1cnJlbmN5U3ltYm9sbmFuU3ltYm9s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QU9FWmF4N1pwSVVoV3lhS2tZaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVA1cXI0VFNjNUxYdng4bWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25TZXR0aW5nc0Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVBTOEpNeGJrcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXFGOEJHdFRpVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVFLVVVxTEtwTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVIzbmJmOGRRcDJmZUxtazMxLmxTZmdBcGF0a2R4c1ZjR2Nya3RvRmQucmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVJSQjVRNnA3Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YXJVQldJTkVZag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVNDSUlFbmNvZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1NjYWxlTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVhOWHRnd3B2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QVk1SHg5SHFFUDU0WHZDcnZMTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YVo3TVZEbnBQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QjBOSDlCN3IzWVR5UXdITXQ0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QkE0VXZORlZNRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkFFdnJkaGVXeUp4VlYxUnVE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkFFeHZyZGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmJka2pLcVVBMVU5WXhuVUxPWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkJtdUhGcW9YMzJId2ZGdWlRYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmRMWkR2N3hpQTRIallKVHBVcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkRxYkg1N0hDanhYM1lRRzVwNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5JbnZva2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QkVQV1RWQkNna1VQTDdIaEJTYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmZxdDJaSG9SU3JBNXVVajBVUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Qmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZXh0ZW5kY29kZXNpZ25zaGEyZzNvY3NwLmNydDA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmliM1dkNzAwdGJmQm12ZWljOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5UmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkluaGVyaXRIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YkoyZkJXN3ZJN0w4R012Z0ZVbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QmpsRldKN0Q4WGllTVdKeVlwOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YmpVYWVFSDdCOTZvZWRUQk9RYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Ymt4WmN2RVp2Slh5WmNmbWlL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Ym5QZndiQnNhNmRkT09LTWVmYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlBjVURzdUVVNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QnBHVXB4QlFXRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"YlFlYnFEcTl5VDhDUGlWRVIyVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QnFueTBEcUJnSW1zRHVHclZCQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlNwV1E5ZXRERUVZMHZHTUYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlRzbnZQQm5rOUkwYlZYWGZKcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"QlYzN0dDQkxiZDJxeXNvcGc4TQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsZW5kYXJtX2RhdGFJdGVtY3VsdHVyZUlE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGluZ0NvbnZlbnRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0Y2hOZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y0JGUlhObXRnd3B2Rm0wczVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZhTzJwdkR0Rmg1RERuWEVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2gzQk95bjlocg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q2lwaGVyTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhc3N0aGlz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q0xOODgyaW9rSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y0xwOXNRN2hSTTFXWmlqaFJMWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q04yZWhkNzRHSzY4THJNREFQYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZUV4Y2hhbmdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcG9uZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbmVyQ29udHJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbnNLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29va2llRGVjcnlwdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1FIMlJMQVNIQTZmQXFzZUxh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1IwOEZLUnNtTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3JZNHNlWlowMEQ0bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3RaN2syQlVFR1g4dkl2NkRVMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VsdHVyZW1fU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lEZWNpbWFsRGlnaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lEZWNpbWFsU2VwYXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lHcm91cFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lHcm91cFNpemVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lOZWdhdGl2ZVBhdHRlcm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lQb3NpdGl2ZVBhdHRlcm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VycmVuY3lTeW1ib2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudFVzZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y3VzdG9tQ3VsdHVyZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Y1ZEUlNMYTVQRFRKSmI4S1FK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Q1hnQkYydlJCZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RDFROFZlTHEzdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RDZ3Qm1KVEJFMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0ZVRpbWVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGF1YXZ4N1NiaVozUzU1ZUgyUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb21tYW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJDb25uZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJEYXRhUmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGJZVUNTSGZFVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZENsQlRTMm5QUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGNPOGVhb2djZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZEQ4UGE0WG5EZnRic2ZrTHQz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGRJQjAycTRwUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXIgRGV0ZWN0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXJOb25Vc2VyQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGVmYXVsdEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"REVGWExIcTAzQXJxQ1JkTzhzQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGVnZUpMV1Bh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlclNoZWxsSG9va1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGVzZXJpYWxpemVPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGdJY1J0SjVDaDB1SENEUTNt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZEgyM1JMU0hB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGljdGlvbmFyeWAy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGlnaXRTdWJzdGl0dXRpb25pc1JlYWRPbmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGtJQk5VWjFkVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RGt5JyEmenw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RE1seUpPN1JhWjdBQk55aXNMTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZG53VTRjbFlVT1M4VlZoWmRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG9ja1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZG9uZjVQS2c0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LmcucmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXMuUmVzb3VyY2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRIZWxwZXJUcmF5LlByb3BlcnRpZXMuUmVzb3VyY2VzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZFA2TFp2SEluTXhBdkRncEF2bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RHEzclNJN1FHZ2kzb1Y4N0RSWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHJyRVUzVmhFbWNuS0tLS0VR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RFRhQnFBTEQwZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHdEZXNpcmVkQWNjZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHdQcm9jZXNzSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHgxOGt2cW1HQUJnTkhlMnM4UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RHluYW1pY01ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZHl1Qnh0Qm9oQVp5eGhZV0xaVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZTA5VU9rUG14bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZTVyOG9wUjBsZ2JRN1RZMmxy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RUN1MVVxR1dLUnVHUEpqZUJD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZWdkQkdyTExKOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWdsMGpON2xhaGdPREE4UkV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZWlndFhsSEhhREU5czFwVWZENw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50SGFuZGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW1iQlhEZUZDOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVmlzdWFsU3R5bGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5kSW52b2tl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW5kc1dpdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNoaWxkV2luZG93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRocmVhZFdpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZU8xYXgxN0V3SjRtdXZlN2pGTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZU9YQllNcHU2UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RU9ZQkV0cUdqQk45RHFlRWZobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZVBmVHNhY1lTUnM5QkJqeDBS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZVFkOHAyd0FEbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXNERlhxMDBReE95VWNqaUhU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZXNLQmloRnN0Tg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRBcmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RVZsalRkNzlHZHlmdW5DUGJVYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZXhiR2doNWxtQnNuTnlwdHZ2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZVJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RVplMUxBcGNxSjU2WWlVM2RT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkFuS2kzcURHYzdNanhqVVViNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkJxQnVOdjRvN29Eb3Q5djZx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkNIQjZraFlXNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkNSUHJHSHVzc25QRTRCVUFv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmYzQnlTdW9MUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmZLQlVmSVVZcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZkhTa2RBbmtKZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmllbGRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmlLdFhsUjJx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFjY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVNoYXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmpwOGg3azFEZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rms1QnVvODJlOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RkwxSGNtcTJ2c1NCSTZUcURsVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RmxhZ3NBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxBbGxvY2F0aW9uVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxNdUQ2cUVCcTIxS2ZKM3MyNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxOZXdQcm90ZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZmxQcm90ZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaW5hbEJsb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm1SOFVISFZ0Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Zm8yQW5JQnVCYmRPWnJxSHB2dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUludFB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"RlMyS2JQcWR4VVJoZlhZRFdqVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZlN5c3RlbS5EcmF3aW5nLkljb24sIFN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYWpTeXN0ZW0uQ29kZURvbS5NZW1iZXJBdHRyaWJ1dGVzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5bVN5c3RlbS5HbG9iYWxpemF0aW9uLkN1bHR1cmVJbmZvLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODlmU3lzdGVtLkRyYXdpbmcuU2l6ZSwgU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZnliQkJPODFHSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZllCSGFZckZkYkpzZW5DbnJ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ZllVMDRWSG45a0ZzbXFmM0pUNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Rlp0OEx2akNQbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Zzh1bGk1QlRBSEtBY3hJWTV4eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R0NIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2NQVVJrQlBNRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGVkQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FsbG93T25seUZpcHNBbGdvcml0aG1z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FwaVVSTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Fzc2VtYmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Jhc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvZGVCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvbnRyb2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlY2xhcmluZ1R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZhY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpZWxkVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhc1Jvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hvdXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQXR0YWNoZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzU3RhdGlj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzVmFsdWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hbmlmZXN0TW9kdWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01heExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01ldGFkYXRhVG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01pbnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01vbnRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1BhcmFtZXRlclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2R1Y3ROYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Jlc291cmNlTWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JldHVyblR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlY29uZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RhcmdldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RleHRMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RocmVhZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsRGF5cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VuaWNvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZlcmJvc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1dQYXJhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWxsQ2hpbGRIYW5kbGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3JlYXRpb25UaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3J5TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUNocm9tZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUVkZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jcnlwdGVkVmFsdWVGcm9tTmFtZUZpcmVmb3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhlY3V0aW5nQXNzZW1ibHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmllbGRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0R2VuZXJpY0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SUxHZW5lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdFdyaXRlVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWFuaWZlc3RSZXNvdXJjZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcGVydHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHVibGljS2V5VG9rZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVxdWVzdFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3ViS2V5TmFtZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0VVJM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmFsdWVOYW1lcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2c1VVNFaDdiUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2phVWJrNmFudg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z2ptb3FUSFlvblM5UEMzRUs1cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTEpMCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTExMC8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBudi1zYTFEMEI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBSb290IENBIC0gUjMx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbiBSb290IENBIC0gUjYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsc2lnbiBUU0EgZm9yIEFkdmFuY2VkIC0gRzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsc2lnbiBUU0EgZm9yIEFkdmFuY2VkIC0gRzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2lnbjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R21sRUV2RGtZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z01OS1FIS1l3Q2hrTVB4ak9q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R08yOHlaWDdRUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R296byBSZWdpb24x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z3B3VUpINUVLVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3FVVHF2SFRJUkxXRDVrS3VYUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3JCczNabXVEZThwQmFXdUJ3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3RtNWlCQkZuQzdXSWJUY1lDSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R1dMX0VYU1RZTEU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"R1hUOFRrOGJxeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Z3lwYzB3cWN4NTBocXNMV1hSWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDRQSFBBVWtyeWE2UUFja1Vs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDRQVUhQQWty","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aDVGZnd5QklCQzJFM0dMWGFrSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aDh4bndocTFTc2N2Q2lyVmhrdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDlVT0JnN3c3cWdXNDVqeG5CdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SDl4SkZiY25V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaHRhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGVscHMgdG8gZG93bmxvYWQgdXBkYXRlcyBmb3IgdGhlIG1haW4gYXBwLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGV4YWdvbiBBSSBMdGQuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGV4YWdvbiBBSSBMdGQuMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aEZlOFFTVlVVNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SGlKc0VJdzk1bEtJTUNrS0h3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SEo1SmhhQjI4bmxkYUtuOElDRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aExad0VCZmFP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SE1LOFpOVFFNdHU3VndFSGo5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SG5hQm9yN2RUdnNnQzRYR3BScw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aE9BVWg5Y1FZRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHBuQmZpdklobw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHJTUnBHN1VITjZkY2NvZkNRYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aFM5aDk1N1g0b2RlQnVpUzhUOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FDQ0VTU0lCSUxJVFlTVEFURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FDVElWQVRFU0hFTExXSU5ET1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0FQUENPTU1BTkQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0dFVE1JTlJFQ1Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX0xBTkdVQUdF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1JFRFJBVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1RBU0tNQU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0FDVElWQVRFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0NSRUFURUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFNIRUxMX1dJTkRPV0RFU1RST1lFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHRtbERlY29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFV0aWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlcXVlc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlc3BvbnNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHUxVXRtYkQ4Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHduZENoaWxkQWZ0ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aHduZFBhcmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aFdUNHJndVNDZG1rSURZSmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SFhkdTNScTVuU251MmJYcFlqbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SHlaaTBVenNmU0tMWE93YmNO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTNZVVZacUZjUnNWbzdZVndvWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"STdIWTZlcWFpV1R1ajZOM3IyYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"STdtb0l2QlpjQmIwZ0VLUUFhTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTdSVTI0OEdWVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aTlLTVlpZXZYQ1VOOVVEWmky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aUFHOE53c2M5UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUFzeW5jUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNvbnRhaW5lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUNyeXB0b1RyYW5zZm9ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aWZ3OVA5cWlRNnRTcTZpNElzSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWlJVVdtTFdabg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aUlsVUVkbHNmcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SWxDUWFGQjVKUW5CV05ZQWRlZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SUxHZW5lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SU9hdm1GN3VIYWlaWWtJMTlwZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SU9yZGVyZWRFbnVtZXJhYmxlYDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JFbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JXaGl0ZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SVNwQVJsSnV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aVlFSEdNbDNs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"aVpyQmxUQ0liNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajFOTFpWUVNwUmxKdXh3TFpF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajY3SlRJYUgyYVlucjBaU045","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ajhQeDJNcUtZOERHc0pGdk5CQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"akNPNTJYSGxuakpBRFp3OVowdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"akQ4YUZEcVNyRDM2ZmQ2MEJ3UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"amZkTlVacTYwUGZLWmRuVE5RUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"amhGZUthcUhDR25haFYzb0Rvbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ampsOHZqc0Fibk9PRmczQ0k3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SkpzTDJSVDND","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Sk1uQnNlZDhJMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"alNDbmRta0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SnNvbkNvbnZlcnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SlR1S2dwQlFyMEpOSlBnUHJGbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Sng1V1A0N2I2SGdZQ2V3VFpnQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"alhlQmt5dWQ0RA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Slh5cmdlWEF4M0tSQ0dRR3cw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azVNRmN1N1AwdzIyZndoQ3NKVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"SzhIQmNGSkZ5UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azhqSnFwSERYU0NWb3ZxSUNSSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"azh2YU1RS0hI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2FQbExacUpTa0VlNUVDTE84Tw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2F1VU12SkF5NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a0IyMk9sQld1RmhGeXFpWTJFMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S0IzVVRndnM1Wg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2UyQm5wdDc5dQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S2V5VmFsdWVQYWlyYDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2hsUHJucXc4YU1GRlg4VmlQSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S0lEUkRTcWV1TlJva0VMRVZOUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a2xSMnFsZVFpSlhHTGRhbXNo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a21lNTNjQjBVYkRLUk80U3FEVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S25YZ0VwQkJG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1BQc0pPTHBz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1MyaXl4N0Jpc0xwQ0xORzJrZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1M1ODhiQmdDQ29LZGxuanZlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"S1Z3NkVIajlC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1dvYW00Qk8yWVJybkZLQkpXTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"a1psVTRRcTVkdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDBiakN1MVVx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDBvSGM2N21ZUk9zZGM5SE9Zdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bDRpOFJlNzI5TlZvWU5wZ2I3Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TDRsZUN5aVdOdTFZaFZRQkln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bDROMHd3QmtObDZ0QjBuOVdwYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEJ3QlBNWWhxbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bENySTNyQjdKcDVvODF5UmwzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TEN2b0NPMTc0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bERXSnY3N09TVEdRamZTS0hPeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bGRaeTkxN1RCM2ZRZHBTcVEycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEdzOGpkT0JqTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bGhHVVpKZ3RKag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TGhubFZaSHc5dnZLQndXaE9iMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bEtPa1dadjhY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG1FOElRdjNsQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBCYXNlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBmbE9sZFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBOdW1iZXJPZkJ5dGVzV3JpdHRlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBzekNsYXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHBzeldpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"THFJVWxqbjRKMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHFuQmhkSE45Q0IyTEwzc1ZDRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFRsN2ZqN0txbkd1WVY1TmlyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"THZKdjA0QnhsM1JuMnFyMUo5MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TFdBX0FMUEhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TFdBX0NPTE9SS0VZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHdKSG5Kd2hQVklJUzZSZXNu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bHhmVWpuMmIzUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFlNb3I1cVJLc2d5SVdEWW9xZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bFo1bmZISDBSRG5jUXdhV3R5Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bTAzczAwN3lmUXc2VkZkdTROaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTBlTnY1cWZEYUVWRWtFcmpoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTFpVTdrS21KOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bTRwMUNOMTBlcjJ4QlRQSThO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TThEZ3l4cWxZZUlERGx5MWdxMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TTlFU3ZHS0ZN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9pc1JlYWRPbmx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9pc1JlYWRPbmx5bV9jdWx0dXJlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9saXN0U2VwYXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9uYW1ld2luMzJMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV9uRGF0YUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGVtX2lzSW52YXJpYW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bV91c2VVc2VyT3ZlcnJpZGVtX3dpbjMyTGFuZ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bWE2QlFBY2tV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFrZUJ5UmVmVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudEJhc2VPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdFNlYXJjaGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWF0Y2hDb2xsZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWRFVXNkRWxsUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVGMllGNFR5OEhwSFlCVXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUdJQU1YSFZQbnQ3d2szM1hvYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWdPOGJUV3A2cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bWgxQnRTNHRMaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LldpbjMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bUp4YlZWMVJ1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TUxuRTQ2Wk9CNGh5TjJCaGx1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TW1zOWhJUk9W","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TW1WOHN5QXRORg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bU9Pbnh3QlYzaUxLMWlGbGVWeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXFtOHF2OW1BUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXJmZG11cVlYcmZPOEZCQkxVUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXNyVXpybzNRbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXRXb2Zab2o2UGI1dmVYS1JH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGljYXN0RGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bXdYR0hHN3FIRGk5WEpyTzlSaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bVpFNkNlSGpHdE1VTmNHWVlZMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bjJSNG5hNmQyZzYwZnE0alBT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bjVSbHFSNzdJdXgySVVhTGtyMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZWRQaXBlU2VydmVyU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVZhbHVlQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlRGlnaXRzbV9kYXRhSXRlbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlRW50cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmF0aXZlU2l6ZU9mQ29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmJDOXRPN1Z2d0N0WjlkOWNDRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TkJVVTBFUUhscg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmNCWGtBN2VPSnBMQW93NmRLMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bkNtZFNob3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmRnVG40Q0JNQjZWODNibk9R","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVTaWdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmVQQkRsMElHWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya0NyZWRlbnRpYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmV3dG9uc29mdC5Kc29u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmZBaHFzZUxh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TmZwdVRWa1JM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bmdGOEUzN2VlcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bk1iUWpocVhLN0VhUDdhWVBPVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnF3TWRJSW4xaTFlc0lxU2JX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnR0OFBUOEpBWGl4bFlXSnlI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TlViOEFVblQwOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyRGVjaW1hbERpZ2l0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyRGVjaW1hbFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyR3JvdXBTZXBhcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyR3JvdXBTaXplcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyTmVnYXRpdmVQYXR0ZXJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"blVPQko2WDFZeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TlVQU3Z4SHR0NUZkQlRrczR4Tw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"bnZvOFNHSTA0UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnlqajhVR21iYkpIdjBvVGJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TnlwcWZKN2ZEVmg2Skh0VEloWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzM3cE82cU4wRmQwdTFWNHlCQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzNWNjN5N3NYbGtMbVFOZHIzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzVTeVpYN2lUcktmTW9Va29icw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"TzYzNXdTZDVvaWN0ajFiaVV5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T1wqKV9QcH4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0FjZ2VRNzhlcVEwVktrWDNTYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0SGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0J5VW1pNG1qVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0gxVTVUYnhmRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T0lSRjFXN3RaaXFkQ2g2cEY1Qg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b2pmVExiN0dQZ1k5b0hEYnVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T2xmZTNiSHVxY0drM3dGSUp4TA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T01TUTRXUG9I","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T241UEtnUDR5S09XWnY4WGZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b05oZ0dQSFVqcUVTM2c3RFhEYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b25uOE0wZWR2TQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T05XQkZwS1VTTFVCZUtNYWxJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T25XaW5kb3dFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfR3JlYXRlclRoYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfSW5lcXVhbGl0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3BfU3VidHJhY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkJhc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1E4T0pmQnJlWmhnZUNTNnV3cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3JkZXJCeURlc2NlbmRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3JFRW1CQm1nQ2lZRFh4SzVCMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1N4a2dBQndPVFRxRnR5Z2RDRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1RhWVFaQmRGRjdFVVR0VFBxUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T1ZRR3dwcVFJZGh2V2NlWjB1Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b1c5clpFY1V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"b3lBRHhKUzNobGlZU1pxUEVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"T3lYVXdZTHRqTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UDBwM2tTcUFOaUFBYk04ZEhIbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cDJjOG1oSnB3YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cDVpYVZQNzZFOUQ2SGZaYUtNMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGFsbTV5Z2ZSSUFOd2N0TGxi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGRaQnZjVVpCRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGVDT3lXTnUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudERlY2ltYWxEaWdpdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudERlY2ltYWxTZXBhcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudEdyb3VwU2VwYXJhdG9ycGVyY2VudFN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudEdyb3VwU2l6ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudE5lZ2F0aXZlUGF0dGVybg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyY2VudFBvc2l0aXZlUGF0dGVybg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGVyZm9ybUxheW91dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cGVyTWlsbGVTeW1ib2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEY1VElscXNGb3VZQWV4U3IzbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEc2ZndncWhQSWxqWDU1a0NTNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEdjOHFadm85","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGdudW9ZRmhTNXEySXJVcUhCLjRJNWE2SlFnR3M2am80eDJkVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UEdzODZwQ1NsNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEd1Rkd3cWpCWnNIbjFaQ2RVNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGlwZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cElTVTF2MkxNdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UGtxR3J4QlBZdnlLbUZoVkxsQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cEwxOEhMa1B5bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UE1iZ1h4QjhOZm9raUwyRzN3QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG5hVHdjUUtkVHkyOVZiMmpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG8wMmk3TTJZaWsxMFd0YnBQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVJbmZpbml0eVN5bWJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVTaWdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cG90WnZWN3BWWE1PMWtuUGpUZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHBEcHRGaDVE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFFpMUpYR0xk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZSBPcmdhbml6YXRpb24x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1RocmVhZENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cHJvZ3Jlc3NCYXIxLk1vZGlmaWVycw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydHlJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFQ3QnB4WnZKMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cFVBdkJRN2tFUTZucHIwWktRMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UHVKOHZTaVlZVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cHZKS1h5WmNm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFdxUGdBM2wxVnI5RXZHS0ZN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UFgxdk1RVWpB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTBONTdCMnM5RFhNajBKcDhr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTJJVTlxaHI3OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UTNIVW9pczFGYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTRxVWFnMzhtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UTYzQmVOdFRCeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTdaQnJ3dU5Iag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTltMVhqcW5Od2lhcUNtQmRpTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cTlOVXlQY003bA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUF5cE85NzE0NkFqVjdCU0xCRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUJoU0ZzV1dhQ1BIeW0za1R1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWNxWnZvQjlPTVM0V1BvSGxY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWNaRGlWSHJ2TXlPM2JDRmlGeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWVYOG5ndEtQSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUZCYUI1bmYxYnlZTjhoTWRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWlLZVVUN1d4ZmR4WjY0c1JFNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cUpBSUVDQnEyNlJsMGRXYWl1dw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cWp2QlptdllxYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUtSNXVHUEpq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UUxRQm9aRlpsTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cU1ZVUJjRzhsVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cU4zWEdyRTFrRjRPQUhmTkZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UU5hVTMxdUxPUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UU5JNjA5RlBrWDlxU1RGbVlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVBhbkpzeTJSVDNDWXMzMHNoYDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UXFLVWJPcVdzUzc4R0JVS3huMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UXFQTmdBbDFW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVN5c3RlbS5EcmF3aW5nLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cXRsVUc1cW5haw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UVRzaXhmeUY2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cXR1OGlLcXZBOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjJqdHUza0I4Q1NSWmlaSWFY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjQ0OHVpZHN1Ug==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjRDa2ZsQkE3MVJaRksyYTVUNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjRIVXJxbHhBWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UjR4VWttNzFXeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjdoODQ3SEVpTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjgyVWVzS1lNaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cjh5WkJmVmI3YUpzTWVoTjRQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmFFVHAxTkxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZE9ubHlDb2xsZWN0aW9uQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFRvRW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnZXhPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGVsbEhvb2tXaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlIaXZl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWaWV3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cmVtb3ZlX1dpbmRvd0V2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZU1ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VNYW5hZ2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdW1lTGF5b3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UkZPR09pNzVsVGtOcWE4dldBTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmdRQkFlOTNHSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cmgycnIyRFRyVmdKNkJSdXQz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UmlqbmRhZWxNYW5hZ2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cmpqOGROcGFvTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Um5HbTFscXJaNnNIS2Q1VDhLUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cm5TeGZnQjFYMmd0WGpOT01Law==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ck9lQktHa29lSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cnAwemFDd0hC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"cnRneU91cExTTlBIMVNkMUl3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUZpZWxkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUhlbHBlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZVR5cGVIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UlZPUHUwN0FYa3hEQTE3NFZldQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Und3WmpIQmV5R1dJWXhKaWptQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UzFlVURXcU84TVhrcVlieUZPOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"UzFKVU55eFU2NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2FCQkl0MDNoZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c0FjaUMxQk5aTnRFSTlVbkhEaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2FkTm1oeDdtNXhONGxBY3ha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2FKQnpTOERZVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2NQeTROcXFZMUdycURTaGxhNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsQmFycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsVG9DYXJldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2RLOEdCRzBFTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlQcm90b2NvbFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2VuZERhdGFUb1NlcnZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZVBvaW50TWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FwaVVSTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0F1dG9TY2FsZURpbWVuc2lvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0F1dG9TY2FsZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NsaWVudFNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbW1hbmRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbnRlbnRMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NvbnRlbnRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0RvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0V4cGVjdDEwMENvbnRpbnVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0lzQmFja2dyb3VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0xvZ0M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X01ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X011bHRpbGluZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X09wYWNpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Njcm9sbEJhcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlY3VyaXR5UHJvdG9jb2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlbGVjdGlvblN0YXJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Nob3dJblRhc2tiYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1RhYkluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZU1hY2hpbmVLZXlTdG9yZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZXJBZ2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1ZlcmJvc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Zpc2libGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29tcGF0aWJsZVRleHRSZW5kZXJpbmdEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGF5ZXJlZFdpbmRvd0F0dHJpYnV0ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0dGluZ3NCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c2Y3eTNJQktScDRjMmFuTWJVWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2dSSURVdUlBRXRqQkxtSks2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFdmVudHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2hWbFFCSWcz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lsZW50QnJvd3NlckZvcm1z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lsZW50QnJvd3NlckZvcm1zLkZvcm0xLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2lXOGc1QmZuOHdUWmRqVmswVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0phRHlJSDhF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0pSOFpqUjhTQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c0p0VHA3OTJyT1RuUHcwNlVh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U0w0OFBxWjRBRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c043dWlJcUlERk1OWmdHSm9kWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c284V0hTQkpjeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U29ydGVkTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29tbWFuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlQ29ubmVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1FMaXRlRGF0YVJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1NEVWNUTUJScw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c1NSQk1qUGlBRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRzV2l0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1RBVGhyZWFkQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVhZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nU3BsaXRPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3VzcGVuZExheW91dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1VzU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkNoYXJTZXQsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c1ZFRnNwN3pManRYaDNnN0FDRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c3ZnTWJOcVpLOHFTdHVhdE1GeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"c3ZNMHdBUEcwZ3hpd3ROZUJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3hQQjJQZHhBTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3luY2hyb25pemVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvZGVEb20uQ29tcGlsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLlNwZWNpYWxpemVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbXBvbmVudE1vZGVs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmUsIFZlcnNpb249My41LjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":1,"total":90},{"value":"U3lzdGVtLkRhdGEuQ29tbW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRhdGEuU1FMaXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ2FsZW5kYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uU29ydFZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8lU3lzdGVtLkdsb2JhbGl6YXRpb24uTnVtYmVyRm9ybWF0SW5mbydTeXN0ZW0uR2xvYmFsaXphdGlvbi5EYXRlVGltZUZvcm1hdEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"U3lzdGVtLklPLlBpcGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk1hbmFnZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":89},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":0,"total":90},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24uRW1pdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuUmVtb3Rpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":1,"total":95},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNDcnlwdG9TZXJ2aWNlUHJvdmlkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQuUmVndWxhckV4cHJlc3Npb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZy5UYXNrcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRpbWVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldlYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUHJvY2Vzc0hvb2tGb3Jt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1p2dWdQZzJUc3hmeUY2ZFhv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"U1p2dWdQZzJUc3hmeUY2ZFhvLlRwVFZrUnBMUlo3VkRucFBlUSt0QXA5Sm0wbEV2RGtZUWVnSkwrUVBhbkpzeTJSVDNDWXMzMHNoYDFbW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dW10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDBIQlNvR29raQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDBtMEZsaFUwQ0Q1bEExeWdD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDBNYWJVV2d5WEwwQ1ZsYUxy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDNKOHdwOGs3NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDQ4V1ozcUxzVGdPSm81Z0JiMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDVtUjVHVGl3SFJwWjc0Zm5K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDdJdEJaaXJKeWlESjVEa0Iw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VDhVV2VON1lRSlc1aWpKV1RpNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dDlPQlZnc3haZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VD4pOTpHN3U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dEFwOUptMGxFdkRrWVFlZ0pM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGFza0ZhY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGR3RjRXcVY2eE1NY1VMR2pGRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGVnRzdONUNT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dEJveEJhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFJlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGZMN2ZabllD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGZ5Qmg2MXAzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGdVVXFMVm1OVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dEhiQjNyWVd5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGhvOG9jYjlVWEZPcnFNU1Uw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkU3RhcnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGltZVNwYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VElYOUhLcXhGWW1kSmNVcXVnZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VGtkU1RmQmN3TWR1bW1Nazh1Tg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VEtrTVc2QlI4MlN0QWFKTjkybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VEtzdkZ2cmwwZ2oyOUtPZllX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG1DOFg2OG0wUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dG5EZGZ0YnNm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG5PQkhLUnJhOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VE5yTkt2cTdnUWZib2o3QTlLNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9CY2t4WmN2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9Cb29sZWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9Mb2NhbFRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9TdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VG9VcHBlckludmFyaWFudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VFBucmg4N0xzS0k5cVBkMXJmNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHBUVmtScExSWjdWRG5wUGVR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHMzcTBzaEV1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHNwODBzdkhrNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VHRLcXY2Zkh5MmVDb0t1Y3Z5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dHZUQkwxeUdxNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VFhGQndacVZnUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTBxTmY5T21OcDZaNGVRWmw0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTFZVUtpc0Q5Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VTNuVWY2Y2JXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTVDQkNNN3Q0UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dTdFUDl0RXFPaVFZWTA4SHR3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUE3QlFMd0pRcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUJMdkc4N2pqbkxJdUROdzhPNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VWQxd3MxTFNVeVVDMFFBSzBT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dUVnS0xwQlk2VGRXZFpWQnNvNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VWdRQmE3Nkh1Rg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dUg4RWZmTUxmWm5ZQ2hXOVpF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dWhHODVJSU4zZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VUx0UDM0QXA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VW1jWVo2eHYz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VW5tYW5hZ2VkRnVuY3Rpb25Qb2ludGVyQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXBsb2FkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVFRVThsS29rRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVF3OHhpRDdJSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VVJCQjdnYUJDZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXJsRGVjb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVJPVk1wTDBhQ3dIQmpjUGtC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXMwVXVwRUEwbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLkRMTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VVRXTlFWQmpFbTYzY09RUVg4SA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVVMVVE5WFEzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVVwY3ZxWU1adnhUckRXakF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dVdFQng5eFdyMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dXdKY3k3NzNxMVhHdW5DZXBDTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjNGOFJFd2NKUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"djQuMC4zMDMxOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"djQ3YzFNN0ZjaGZLTFhDTWJyag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjRyOWNCQk1ReWxiZ3ZWUUY3dw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VjVQbFZUQnloWDlpSnlEOEZ2Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dmFsaWRGb3JQYXJzZUFzQ3VycmVuY3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dmFsaWRGb3JQYXJzZUFzTnVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmFsdWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmNxTFFKQnp4N1FLU1FHRlRIZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dkQ0M0l0cXAzM3ZTTXZJckdPQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VkQ1Rkp5VDIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmVVcDhzcXZSOXdtUFdIbFRZRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"Vmdjam5mN0pQakdjU0FSTXB2Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VkhRVUZxYXR2VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VmljdG9yaWEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlBBZFc5cTNMVDJqUVBjZVJ3Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlJsYlJ0NVF5SVcycWN4WmR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlNUZ3dmQlhWZ0lKNjZuWHF5Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VnRuYkx4UVY0NVVvYnZ0a25r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlVibXVtQkhyMU5ITjlQSURvaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlV0WDh2NE1RS0hIN0N2Q08x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dnZoVVZsQkI4Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlZZTlBidVlZNGdhQlhVSFdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dngzWDhsQmJJZFlYcGFsTjFwZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dlhvSVFEOFBh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VlpuQjQ2SDVxbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzBXTDhrSEJHSW9HTDFxYTZ2bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dzFWSlhOQjRXalhSZXRKUWtKYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzI2ZTQycXo0T2xBNU9QdmVNag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzZNd1Z0cWI4RHdKclVMeHZaVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzhEVWluVzFRdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"dzhFQlIxQnExYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"VzhaeU5RTXR1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvckNvbm5lY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViSGVhZGVyQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViUmVxdWVzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2ViUmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0dvTEtmQjlwUEdHMzVQdWxzVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0g2cXdndE51cGRxanB0QVF1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2hsREtzN01iUEx5aVBsR05nWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d2hZNHNlWnVZT2NxZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93RXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93SGFuZGxlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0lXNWhJQkJLRmk3RXJSd1ozSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0o3R2Q2cTgxV25KTXYzM1NYaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d0p4aUZTSFhyMEhVb3BXMTJ4bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0s2aWd0b05iZWNjU2pSZWxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V0x2RHdwcXQ1bUJDeU1KZXZiVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V05vQmJCdnU5NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V29SVW5JWXZZTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1BKT0xwWnNqOXhGYmNuVXIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3F2b1lpSDkwbG12TlR0eXl0UQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVMaW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfTEFZRVJFRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfTk9BQ1RJVkFURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1NfRVhfVFJBTlNQQVJFTlQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1NYeTliSEFxWkdrNnJwNVM0Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d1RlVlNHQmkxZFNlclhQT0FjTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3RHMHlKQkRNNWY0T0NSbmJZNg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1RVVUlPQ0NEYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1djWE9USWZRM2IxamRtc0dh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V3hUS0VucTRlV05pTk5OeHF1NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"V1lXcGhycVBrOW1rWTdKWHFmSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"d3l3VWdvZEJzWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WDBHV1FocWc4M2E5MjBCSWVPOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WDR5MmFSSGRBMmV5SkpUczZ5cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGE5RERkN2d2b09GakZxSUU0bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEJDVndXVDRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGJvYzJ2N05rbUxyV0t2aUllNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eENBVVlTZWVQag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEVQQmdPbmMyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGVzV0lxU2JX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGZkQjhUVUx4bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eEZVUzNGTmd3ZHNRZVZseHNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eGhjbUlZYUhS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WGw5Uk5yWTFQZ2NUMFRwMmxj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WE1RVWpBOGVoY0lZYUhSQ2FF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eG5qWDVPQjZuTVRBVGMxVUZrbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WG9wc0hDQnZLV0RGeFByTkFzUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eFFZNFp2dWdQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHNiZ1pJQnlNeG93bGducnh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eHVjRDVKNnlUMjJ3WUVHTWwz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHZXQjFYSG1uSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WHlieVlvcUMzbmt1NThPNnhoWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eTFCOVF4cWs5RWRLVGoycHhBbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WTJ3OXFnYjA5VGpJQ3JFWThU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eTVJQjk4M2daag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUJsbXBGN2FTcG5WU2xUUDUwdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWNFU3FBcXlibkhldTdTVENoWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWNQdGQ2eVNDbkJhT1hQbWI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUNRVVh3OFVrbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWdtNktLQmxxa1lQVUZodHNNRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eWd4TVRHVU5SUU1PamhGRXZS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eUhoSUFkQnRJTDM1SEdxSVJqZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WUlDUWcyN25EZUxaTGpvV2xvUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eWtvc0xJcXVJM2FmNm5LYVZVNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WWxtVWRiQjNyYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU0zOGdpOWZubw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU04aVJoSDRvaEtVY0pxVkNpVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eU1MRTl0N2Nzd29CSkJZVjkwdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eVBkOTVLY2xnRm9GSlBlOTFH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eXBIV05HQzZBaUVXVGRZaE42","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WVFZVVBObjRwVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WVJKODMyT0FscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"eXJsNG1MTmZqcXh3a3JZQWoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WXJ4SlFWQWFiOGJsUGIyNnRa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"WXQweUVhSEN5OE5DUk85QTA5NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejBQSFZicU1yOUJvWUdTOGZrcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejZvODI2QnB0NWx0ckFXb1NRNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejZXVUFRSWVIYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejcwM3B3cVRJOFpTOGdtYWl5aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ejdYQmo4YWNDaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"emY5RlBTMERCQUdTWWR4eElh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ekc0QmR3dW5MaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"em54eXBmSFF2SnhKSmxUSDJBeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"elNEbmg1M3dCa09nMlA5ZnR2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"endNMmRJbjFp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"enhhWXFld04xZmVnN041Q1Nh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"enhhWllxZU4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTEwMDA5LTExMTEyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTIwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTMwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTQwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAwfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAxfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null},{"value":"ezExMTExLTIyMjIyLTUwMDAxLTAwMDAyfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"DownloadHelperTray","compromised":null,"detection_total":null,"total":null}]},{"name":"DownloadHelperTray.exe:2096","strings":[{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcRG93bmxvYWRIZWxwZXJUcmF5XCouZGI=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcRG93bmxvYWRIZWxwZXJUcmF5XCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcXCo=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxtc2NvcmVlaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzE5ZGM0NDktYWRhNS01MGY3LTQyOGUtOTU3ZGI2NzkxNjY4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzYzZmQ3NTQtNzA4Ni00ZGZlLTk1ZWItYzAxYTQ2ZmFmNGNh","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OGU5ZjUwOTAtMmQ3NS00ZDAzLThhODEtZTVhZmJmODVkYWYx","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YTY2OTAyMWMtYzQ1MC00NjA5LWEwMzUtNWFmNTlhZjRkZjE4","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dBbGxVcmlFbmNvZGluZ0V4cGFuc2lvbg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEYW5nZXJvdXNVbmljb2RlRGVjb21wb3NpdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2MyYmNiYmEtMTZiNi00Y2YzLTg5OTAtZDc0YzJlOGFmNTAw","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50Q2FjaGVTaXpl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xSTG9hZExvZ0Rpcg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJnSklURGVidWdMYXVuY2hTZXR0aW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJnTWFuYWdlZERlYnVnZ2Vy","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2T3ZlcnJpZGVFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNvbmZpZ0NhY2hl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1TSVBlZWs=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRDYWNoZVF1b3RhSW5LQg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZTEzYzBkMjMtY2NiYy00ZTEyLTkzMWItZDljYzJlZWUyN2U0","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTG9n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZVNJTUQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlTWlsbGlzZWNvbmRzQmV0d2VlblJldHJpZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlUmV0cnlBdHRlbXB0cw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFyZHdhcmVJRA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFdSUG9ydFJldXNlT25Tb2NrZXRCaW5k","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5kZXgzMjU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbFJvb3Q=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5UG9saWN5VGltZVN0YW1w","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nRmFpbHVyZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nUmVzb3VyY2VCaW5kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9DbGllbnRDaGVja3M=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T25seVVzZUxhdGVzdENMUg==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3B0aW1pemVVc2VkQmluYXJpZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVxdWlyZUNlcnRpZmljYXRlRUtVcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NoU2VuZEF1eFJlY29yZA==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NoVXNlU3Ryb25nQ3J5cHRv","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRGVmYXVsdFRsc1ZlcnNpb25z","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHVybk9mZlNQSUFuaW1hdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSHR0cFBpcGVsaW5pbmdBbmRCdWZmZXJQb29saW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlTGVnYWN5SWRlbnRpdHlGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlTGVnYWN5VjJSdW50aW1lQWN0aXZhdGlvblBvbGljeURlZmF1bHRWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU2FmZVN5bmNocm9ub3VzQ2xvc2U=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU3RyaWN0SVB2NkFkZHJlc3NQYXJzaW5n","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlU3RyaWN0UmZjSW50ZXJpbVJlc3BvbnNlSGFuZGxpbmc=","type":"Ansi","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0Zvcm1zUGFya2luZ1dpbmRvdw==","type":"Unicode","source":"Runtime Data","process":"DownloadHelperTray.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"DownloadHelperTray.exe.log","strings":[{"value":"MSwiZnVzaW9uIiwiR0FDIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"$42","type":"Ansi","source":"File String Dumps","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"$43","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MSwiV2luUlQiLCJOb3RBcHAiLDE=","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiQWNjZXNzaWJpbGl0eSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLDA=","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLkRyYXdpbmcsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MiwiU3lzdGVtLldpbmRvd3MuRm9ybXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5Iiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIiVXSU5ESVIlXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzMyXFN5c3RlbVwyYzNjOTEyZWE4ZjA1OGY5ZDA0YzQ2NTAxMjhmZWIzZlxTeXN0ZW0ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvbmZpZ3VyYXRpb24sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLkNvcmUsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null},{"value":"MywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCIlV0lORElSJVxhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV8zMlxTeXN0ZW0uWG1sXDE1YWYxNmQzNzNjZjA1MjhjYjc0ZmM3M2QzNjVmZGJmXFN5c3RlbS5YbWwubmkuZGxsIiww","type":"Ansi","source":"Dropped File","process":null,"filename":"DownloadHelperTray.exe.log","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"P19jPjlfXzBfP19fX3QzX19fX19fX21lOWVfTGxfPz9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"XyIiIl8/IiIi","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["1.0.1.0","16.0.0.0","16.8.1.0","DownloadHelperTray.pdb","http://downloadhelpertray.properties","http://system.data","http://system.io","http://system.management","http://system.net","http://system.security"],"tags_details":[],"sample_flags":["Extracted Files"],"suricata_alerts":[],"version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2020"},{"id":"Assembly Version","value":"1.0.1.0"},{"id":"InternalName","value":"DownloadHelperTray.exe"},{"id":"FileVersion","value":"1.0.1.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":"Helps to download updates for the main app."},{"id":"ProductName","value":"DownloadHelperTray"},{"id":"ProductVersion","value":"1.0.1.0"},{"id":"FileDescription","value":"DownloadHelperTray"},{"id":"OriginalFilename","value":"DownloadHelperTray.exe"}],"apk_info":null,"apps_info":[{"name":"Access","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.20.17"},{"name":"Chrome","product":null,"version":null},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Firefox","product":null,"version":null},{"name":"Flash","product":"Shockwave Flash","version":"32,0,0,114"},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.16299.15"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1610.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.6022.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.6009.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.6024.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":"Microsoft visual C# v7.0 / Basic .NET","file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[{"value":"3.5.0.0","stream_uid":"72248e24644abcdc01b3effe0f876b1a-6000178-TpTVkRpLRZ7VDnpPeQ~esKBihFstN","stream_modal_data_link":"/bff/report/6508440d23e336997707082c/processes/00000000-00002096/streams/0/72248e24644abcdc01b3effe0f876b1a-6000178-TpTVkRpLRZ7VDnpPeQ~esKBihFstN"}],"language":"NEUTRAL","authentihash":"726ccb5ba6aed9abacc4cad7430051c1f694f1faab9d6a58e264d7d59b405232","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":"DownloadHelperTray.pdb","pdb_guid":"ACF3AC6519D04A3BAF8B7FC2416B40DA","file_sections":[{"name":".text","entropy":5.86787562168,"virtual_address":"0x2000","virtual_size":"0x20b54","raw_size":"0x20c00","md5":"004a726c2b9fa1b8fbe19154b05bf12b","characteristics":["IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_READ"]},{"name":".rsrc","entropy":3.51994776529,"virtual_address":"0x24000","virtual_size":"0x64c","raw_size":"0x800","md5":"06dac502be5f8e85acda16d621f400a9","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".reloc","entropy":0.101910425663,"virtual_address":"0x26000","virtual_size":"0xc","raw_size":"0x200","md5":"d531c8684fcc016537d56b454ed8dda5","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":48,"entrypoint_preview_instructions":["jmp dword ptr [0x402000]","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al","add byte ptr [eax], al"],"file_resources":[{"name":"RT_VERSION","rva":"0x240a0","size":"0x3c0","type":"data","language":"neutral"},{"name":"RT_MANIFEST","rva":"0x24460","size":"0x1ea","type":"XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators","language":"neutral"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[{"name":"IMAGE_DIRECTORY_ENTRY_EXPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IMPORT","virtual_address":"0x22b00","virtual_size":"0x4b","is_in_section":".text"},{"name":"IMAGE_DIRECTORY_ENTRY_RESOURCE","virtual_address":"0x24000","virtual_size":"0x64c","is_in_section":".rsrc"},{"name":"IMAGE_DIRECTORY_ENTRY_EXCEPTION","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_SECURITY","virtual_address":"0x21800","virtual_size":"0x26d0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BASERELOC","virtual_address":"0x26000","virtual_size":"0xc","is_in_section":".reloc"},{"name":"IMAGE_DIRECTORY_ENTRY_DEBUG","virtual_address":"0x22aac","virtual_size":"0x1c","is_in_section":".text"},{"name":"IMAGE_DIRECTORY_ENTRY_COPYRIGHT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_GLOBALPTR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_TLS","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IAT","virtual_address":"0x2000","virtual_size":"0x8","is_in_section":".text"},{"name":"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR","virtual_address":"0x2008","virtual_size":"0x48","is_in_section":".text"},{"name":"IMAGE_DIRECTORY_ENTRY_RESERVED","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null}],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":["evasive"],"tags":["evasive"],"submissions":[{"submission_id":"68bcc1c98aa0bc437a05e3b6","filename":"DownloadHelperTray.exe","url":null,"created_at":"2025-09-06T23:20:41+00:00"},{"submission_id":"666331193c4b29472003a621","filename":"DownloadHelperTray.exe","url":null,"created_at":"2024-06-07T16:11:05+00:00"},{"submission_id":"6508440d23e336997707082d","filename":"DownloadHelperTray.exe","url":null,"created_at":"2023-09-18T12:35:25+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[{"filename":"00000000-00002096.00000002.73391.043F0000.00000040.mdmp","address":"043F0000","flags":"00000040","file_process":"DownloadHelperTray.exe","file_process_pid":2096,"file_process_sha256":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","file_process_disc_pathway":"Z:\\DownloadHelperTray.exe","verdict":"suspicious"},{"filename":"00000000-00002096.00000000.69552.043F0000.00000040.mdmp","address":"043F0000","flags":"00000040","file_process":"DownloadHelperTray.exe","file_process_pid":2096,"file_process_sha256":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","file_process_disc_pathway":"Z:\\DownloadHelperTray.exe","verdict":"suspicious"},{"filename":"00000000-00002096.00000001.71472.043F0000.00000040.mdmp","address":"043F0000","flags":"00000040","file_process":"DownloadHelperTray.exe","file_process_pid":2096,"file_process_sha256":"15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","file_process_disc_pathway":"Z:\\DownloadHelperTray.exe","verdict":"suspicious"}],"analysis_related_urls":[]},"warnings":["Not all Falcon MalQuery lookups completed in time","Not all IP/URL string resources were checked online","Not all sources for indicator ID \"api-263\" are available in the report","Not all sources for indicator ID \"api-243\" are available in the report","Not all sources for indicator ID \"api-161\" are available in the report","Not all sources for indicator ID \"api-102\" are available in the report","Not all sources for indicator ID \"api-124\" are available in the report","Not all sources for indicator ID \"hooks-8\" are available in the report","Not all sources for indicator ID \"registry-177\" are available in the report","Not all sources for indicator ID \"registry-172\" are available in the report","Not all sources for indicator ID \"string-57\" are available in the report","Not all sources for indicator ID \"string-127\" are available in the report","Not all sources for indicator ID \"string-138\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/6508440d23e336997707082c/download/files/report_json","file_size":681199},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/6508440d23e336997707082c/download/files/memory_strings","file_size":1615},"certificate":{"file_name":"certificate.crt","download_url":"/bff/report/6508440d23e336997707082c/download/files/certificate","file_size":9928},"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/6508440d23e336997707082c/download/files/network_pcap","file_size":146598},"memory_dumps":{"file_name":"memory_dumps_all.zip","download_url":"/bff/report/6508440d23e336997707082c/download/files/memory_dumps","file_size":3125086}},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":43.0014},{"x":1,"y":9.14078},{"x":2,"y":8.43754},{"x":3,"y":30.7033},{"x":4,"y":9.75036},{"x":5,"y":8.51566},{"x":6,"y":13.7213},{"x":7,"y":8.65833},{"x":8,"y":8.90633},{"x":9,"y":22.7963},{"x":10,"y":41.4063}],"memory_usage":[{"x":0,"y":30.9887},{"x":1,"y":30.8985},{"x":2,"y":30.7331},{"x":3,"y":31.1544},{"x":4,"y":31.1417},{"x":5,"y":30.9566},{"x":6,"y":30.7059},{"x":7,"y":30.5228},{"x":8,"y":30.5642},{"x":9,"y":30.7897},{"x":10,"y":30.7883}],"disk_read":[{"x":0,"y":3632910},{"x":1,"y":0},{"x":2,"y":9522.77},{"x":3,"y":919232},{"x":4,"y":6134.24},{"x":5,"y":103017},{"x":6,"y":27759.2},{"x":7,"y":0},{"x":8,"y":3276.75},{"x":9,"y":358809},{"x":10,"y":78288.7}],"disk_write":[{"x":0,"y":7941830},{"x":1,"y":786014},{"x":2,"y":773137},{"x":3,"y":3159560},{"x":4,"y":793770},{"x":5,"y":193438},{"x":6,"y":784467},{"x":7,"y":427821},{"x":8,"y":248419},{"x":9,"y":480900},{"x":10,"y":1346270}],"network_packets":[{"x":0,"y":58.5666},{"x":1,"y":21.9998},{"x":2,"y":16.0993},{"x":3,"y":14.9998},{"x":4,"y":29.1536},{"x":5,"y":16.3004},{"x":6,"y":5.59147},{"x":7,"y":5.59056},{"x":8,"y":95.1987},{"x":9,"y":137.645},{"x":10,"y":113.906}],"page_file":[{"x":0,"y":734646000},{"x":1,"y":730931000},{"x":2,"y":723378000},{"x":3,"y":740389000},{"x":4,"y":740762000},{"x":5,"y":732602000},{"x":6,"y":720830000},{"x":7,"y":718148000},{"x":8,"y":720609000},{"x":9,"y":731464000},{"x":10,"y":731410000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5","7b1d6976fd8a53d7225b2bda4422e6869a6ff87afa2d348ff7c8f4d5e85c08f1"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious SmileMotion — Falcon Sandbox Report — Score 51/100 — Sample 15c01f65d8db… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 6508440d23e3…. Malware family: SmileMotion. Threat score 51/100. 0 malicious and 9 suspicious behavioral indicators across 120 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5/6508440d23e336997707082c"}],["$","meta","4",{"property":"og:title","content":"Malicious SmileMotion — Falcon Sandbox Report — Score 51/100 — Sample 15c01f65d8db… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 6508440d23e3…. Malware family: SmileMotion. Threat score 51/100. 0 malicious and 9 suspicious behavioral indicators across 120 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5/6508440d23e336997707082c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious SmileMotion — Falcon Sandbox Report — Score 51/100 — Sample 15c01f65d8db… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 6508440d23e3…. Malware family: SmileMotion. Threat score 51/100. 0 malicious and 9 suspicious behavioral indicators across 120 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]