24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 67180b1aaff6… — Score 100/100 — Sample 1eb7b02e18f6…","description":"Malicious verdict for sandbox report 67180b1aaff6…. Threat score 100/100. 6 malicious and 10 suspicious behavioral indicators across 159 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798/67180b1aaff61a299c0507cc","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798"],"about":{"@type":"SoftwareApplication","name":"decoded_file.exe","applicationCategory":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","identifier":"1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":6,"suspicious":10,"totalSignatures":159},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1230,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "decoded_file.exe") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "decoded_file.exe") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "decoded_file.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "decoded_file.exe") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "decoded_file.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "decoded_file.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "decoded_file.exe") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "decoded_file.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "decoded_file.exe") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "decoded_file.exe") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "decoded_file.exe") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "decoded_file.exe") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "decoded_file.exe") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "decoded_file.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "decoded_file.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "Aes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "CryptographicException"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "DeriveBytes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "HMAC"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "HMACSHA256"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "SHA256Managed"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "decoded_file.exe") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp")26:T71a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions27:T9ee,"decoded_file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868) "decoded_file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868) "decoded_file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000078dcaf001cdcaf00226e03770000ed02000000002d6e0377a69cb68e2d000000ecb7f573a0dcaf0000007e003095cb02687ac6020100000080000000e0dbaf0000007e0064dcaf0070c80477423110f9feffffff2d000000d0cc04742700000034dcaf00856a05771c230a7774dcaf00f85f057708000000bb690477b2690477ce9cb68e2d000000ecb7f57327000000d0cc047448dcaf002d000000d0cc04742700000078dcaf00856a05771c230a77c0dcaf007e8a0374ee8c0374738a03745dc3d3162d000000ecb7f57327000000d0cc0474e427ed027827ed025dc3d31688dcaf00fc52417474ddaf00e0840374a5ee4362feffffff738a0374 (UID: 00000000-00001868) "decoded_file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000646f187d646f00000000d0a9817600007a7690117b76d8f1cb02a8d4c6020011cf02e0ecd307feffffff88efd307506ac477b4228ab0feffffffa0edd307eaa9c077d8f1cb02000000000011cf02a11400000a000b00b297646f5c76646f6876646f0011cf02b0bfcf02140000000000000000000000d8f1cb02c8edd307cc2dc5770011cf02000000000c11cf0200000000f8005d6f00000000cc0d24385ce8c3776840c2772c0400000011cf02000000007740c277000000000100000004f2cb02180000000000000038eed3074008000000000000000000000011cf0200005d6ffefffffffcf1cb022c04000000000000000000002345c27728eed307 (UID: 00000000-00001868)28:T1016,"decoded_file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001868) "decoded_file.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001868)29:T5371,"decoded_file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptFindOIDInfoW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CryptDecodeObjectW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetWindowsHookEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter MapVirtualKey (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter MapVirtualKeyA (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00001868) "decoded_file.exe" called "GetProcAddress" with a parameter CallNextHookExW (UID: 00000000-00001868)2a:T1314,Found reference to API (Indicator: "SystemParametersInfoA"; File: "decoded_file.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "decoded_file.exe") Found reference to API (Indicator: "GetProcessById"; File: "decoded_file.exe") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "decoded_file.exe") Found reference to API (Indicator: "GetModuleHandle"; File: "decoded_file.exe") Found reference to API (Indicator: "GetTempFileName"; File: "decoded_file.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "decoded_file.exe") Found reference to API (Indicator: "SetThreadExecutionState"; File: "decoded_file.exe") Found reference to API (Indicator: "GetKeyState"; File: "decoded_file.exe") Found reference to API (Indicator: "GetTempPath"; File: "decoded_file.exe") Found reference to API (Indicator: "RtlSetProcessIsCritical"; File: "decoded_file.exe") Found reference to API (Indicator: "GetLastInputInfo"; File: "decoded_file.exe") Found reference to API (Indicator: "Sleep"; File: "decoded_file.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "decoded_file.exe") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; File: "decoded_file.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "decoded_file.exe") Found reference to API (Indicator: "GetWindowText"; File: "decoded_file.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "decoded_file.exe") Found reference to API (Indicator: "ToUnicodeEx"; File: "decoded_file.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "decoded_file.exe") Found reference to API (Indicator: "SetWindowsHookEx"; File: "decoded_file.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "decoded_file.exe") Found reference to API (Indicator: "MapVirtualKey"; File: "decoded_file.exe") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001868.00000002.121044.02C60000.00000004.mdmp")2b:T79e,"\BraveSoftware\Brave-Browser" in Source: decoded_file.exe "\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci" in Source: decoded_file.exe "\BraveSoftware\Brave-Browser\User Data" in Source: decoded_file.exe "Software\" in Source: decoded_file.exe "\\BraveSoftware\\Brave-Browser" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ "\\Opera Software\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ "\\Opera Software\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ "\\Opera Software\\Opera GX Stable\\Local Extension Settings\\chrome-extension://djclckkglechooblngghdinmeemkbgci" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ "\\BraveSoftware\\Brave-Browser\\User Data" in Source: 6000031-cctor "Software\\" in Source: 6000061-cctor "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp "Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp "Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp "Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp2c:T546,"decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "decoded_file.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135]2d:T4bd,Observed unmanaged function "SetWindowsHookEx" in "decoded_file.exe" Observed unmanaged function "UnhookWindowsHookEx" in "decoded_file.exe" Observed unmanaged function "CallNextHookEx" in "decoded_file.exe" Observed unmanaged function "GetModuleHandle" in "decoded_file.exe" Observed unmanaged function "GetForegroundWindow" in "decoded_file.exe" Observed unmanaged function "GetWindowThreadProcessId" in "decoded_file.exe" Observed unmanaged function "GetKeyState" in "decoded_file.exe" Observed unmanaged function "GetKeyboardState" in "decoded_file.exe" Observed unmanaged function "GetKeyboardLayout" in "decoded_file.exe" Observed unmanaged function "ToUnicodeEx" in "decoded_file.exe" Observed unmanaged function "MapVirtualKey" in "decoded_file.exe" Observed unmanaged function "GetLastInputInfo" in "decoded_file.exe" Observed unmanaged function "GetWindowText" in "decoded_file.exe" Observed unmanaged function "CheckRemoteDebuggerPresent" in "decoded_file.exe" Observed unmanaged function "SetThreadExecutionState" in "decoded_file.exe" Observed unmanaged function "RtlSetProcessIsCritical" in "decoded_file.exe" Observed unmanaged function "SystemParametersInfoA" in "decoded_file.exe"2e:Te4b,"decoded_file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 765c0000 "decoded_file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 765c0000 "decoded_file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 765c0000 "decoded_file.exe" loaded module "KERNEL32" at base 75bc0000 "decoded_file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727e0000 "decoded_file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71d00000 "decoded_file.exe" loaded module "ADVAPI32.DLL" at base 764f0000 "decoded_file.exe" loaded module "SHELL32.DLL" at base 73f30000 "decoded_file.exe" loaded module "KERNEL32.DLL" at base 75bc0000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "decoded_file.exe" loaded module "BCRYPT.DLL" at base 732d0000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71cd0000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75a40000 "decoded_file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 714b0000 "decoded_file.exe" loaded module "ADVAPI32" at base 764f0000 "decoded_file.exe" loaded module "OLE32.DLL" at base 75aa0000 "decoded_file.exe" loaded module "SSPICLI.DLL" at base 75930000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "decoded_file.exe" loaded module "CRYPT32.DLL" at base 76230000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32" at base 0 "decoded_file.exe" loaded module "CRYPT32" at base 76230000 "decoded_file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 713a0000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "decoded_file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f660000 "decoded_file.exe" loaded module "VERSION.DLL" at base 75650000 "decoded_file.exe" loaded module "NTDLL.DLL" at base 77bd0000 "decoded_file.exe" loaded module "USER32.DLL" at base 767a0000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "decoded_file.exe" loaded module "WS2_32.DLL" at base 75fd0000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73200000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71390000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71340000 "decoded_file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 753e0000 "decoded_file.exe" loaded module "IMM32.DLL" at base 76920000 "decoded_file.exe" loaded module "COMCTL32.DLL" at base 6f5d0000 "decoded_file.exe" loaded module "GDI32.DLL" at base 75f90000 "decoded_file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "decoded_file.exe" loaded module "PSAPI.DLL" at base 75a300002f:T48d,"decoded_file.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"30:T48d,"decoded_file.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"31:T48d,"decoded_file.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"32:T785,Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001868-00000C28-834498250] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001868-00000C28-834817021] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001868-00000C28-861168353] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001868-00000C28-861421783] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001868-00000C28-861586476] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001868-00000C28-861859270] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001868-00000C28-861915482] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001868-00000C28-861925827] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001868-00000C28-862045595] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00001868-00000C28-862062177] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001868-00000C28-883625957]33:T5ce,"decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "decoded_file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")34:Ta5b,"decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DECODED_FILE.EXE"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DECODED_FILE"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "")35:T495,"decoded_file.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "decoded_file.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "decoded_file.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "decoded_file.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "decoded_file.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "decoded_file.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll"36:Tbb9,"decoded_file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "decoded_file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "decoded_file.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "decoded_file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\CRYPT32.DLL" "decoded_file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPT32.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\CRYPT32.DLL" "decoded_file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\NTDLL.DLL"37:T7e0,"decoded_file.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "decoded_file.exe" trying to access non-existent file "C:\DECODED_FILE.EXE.CONFIG" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "decoded_file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DECODED_FILE.EXE.LOG" "decoded_file.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KLOASO" "decoded_file.exe" trying to access non-existent file "C:\DECODED_FILE.INI" "decoded_file.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "decoded_file.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Crypto\OIDINFO" "decoded_file.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Crypto\OIDInfo" "decoded_file.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "decoded_file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "decoded_file.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "decoded_file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "decoded_file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "decoded_file.exe" trying to access non-existent file "C:\DECODED_FILE.EXE.LOCAL" "decoded_file.exe" trying to access non-existent file "C:\decoded_file.exe.Local\"38:T65b,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveBufferSize" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendBufferSize" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Add" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Remove" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Item" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Count" in "decoded_file.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Clear" in "decoded_file.exe"39:T61e,"decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00001868) "decoded_file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001868) "decoded_file.exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00001868) "decoded_file.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\* (UID: 00000000-00001868) "decoded_file.exe" called "FindNextFileW" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00001868) "decoded_file.exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00001868) "decoded_file.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\* (UID: 00000000-00001868)3a:T14f4,Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "decoded_file.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "decoded_file.exe") Found string "FromBase64String" (Indicator: "base64"; File: "decoded_file.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "decoded_file.exe") Found string "ToBase64String" (Indicator: "base64"; File: "decoded_file.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "decoded_file.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "decoded_file.exe") Found string "GZipStream" (Indicator: "GzipStream"; File: "decoded_file.exe") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "decoded_file.exe") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "decoded_file.exe") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "decoded_file.exe") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "decoded_file.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "decoded_file.exe") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "decoded_file.exe") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "decoded_file.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "decoded_file.exe") Found string "bKvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==" (Indicator: "aes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "aes"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "aescryptoserviceprovider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "base64"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; File: "decoded_file.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "decoded_file.exe") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001868.00000000.117202.02C60000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp") Found string "and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001868.00000000.117202.02C60000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp") Found string "KvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==" (Indicator: "aes"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00001868.00000002.121044.006C2000.00000002.mdmp")3b:T9f2,"decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "decoded_file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3c:T103f0,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy8faxlV2HevTUaWchCyKLIQpbrui61LDq1HMehlBJ6cShxjXEpGRzXNc5gjz/xx9gef2Ebj/H4Y/w9NsaA4xDqOISkEYoi1FpWBIg3L40oQgihCKWRlSJEUVRFCKHoFUL3jef47lnPb+397LPvOffcr+en549z1lp77bXWPuO9fjdhNc3iOFvzI803NYckJzSSUezQeHZqZuFkzVYAz2hhfF+jDDyy+zXKLs3CeKfmyivXKjfcILnzTsndd0sefVTyqU9JnnxS8tBDEvR8442SvXslF1wgee97Jf/230re9S7Jr/yK5O1vl/yrfyX5pV+SnHmm5IwzJP/yX0pOOUXyj/+x5MQTJf/kn0hQ+4/+kQSN/+k/lfyzfyY5/XQJJvirvyrBWmEl//2/l5x3nuTXf13y7ndLlpYk6Pnf/BsJhnH22RL0jKfwL/6F5J//cwmeIMb8G78hufRSyZ49Ev2X8tU1g//214wDluX/0STzyZe+tOnC34ryv5TT/vv/WUxwXw4rhLB1iRBudiKEcyJCGCGMEEYI5woVUKHVJKtOpVsbP/ytKBCz2tzWKLgvhxVC2LpECDc7EcI5ESGMEEYII4RzhQqo0GqSVafSrY0f/lYUiFltbmsU3JfDCiFsXSKEm50I4ZyIEEYII4QRwrlCBVRoNcmqU+nWxg9/KwrErDa3NQruy2GFELYuEcLNToRwTkQII4QRwgjhXKECKrSaZNWpdGvjh78VBWJWm9saBfflsEIIC+ecMi++2JR58EFJ0+yWYC/+Vg14ncZ3dYaG2GvfpgEYBrbmzS8krFXepPH3JRdoPqDx/LEG/I3G8nqNR5fummskxLsWfwzgUo3lWA25ViOce66kaV6RDCwO/qIBfijxXUGf7rpLcvCg5OmnJY8/LrnvPskdd0iuv15y3XWSq66SwC2vvtrliiskl18uwY327ZPcdpvkllskUE0sDia4f7/k1lslqMWyY5DXXitBLVYSPd9+uwRjhocjn/iEBP8Jxo8Bje+5R/Lxj0sOHJBgVPfe64LGH/uYBFPAMHBfjApTwAT9tfhtYFRojBlpLfamIYQFw9diCGHhnBMhjBB2iwrQpYsQRggjhBHCCGEIYXb4WgwhLJxzIoQRwm5RAbp0EcIIYYQwQhghDCHMDl+LIYSFc06EMELYLSpAly5CGCGMEEYII4QhhNnhazGEsHDOiRBGCLtFBejSRQgjhBHCCGGEMIQwO3wthhAWzsUaYccOSYVuoFVFfvzjpgwbY4t8jIZYX6K2HdYoOzU4zhSOx/ui53Ml6PldGt9YqZb95xqgetz8vYQz0lqCrjR8Rk9owPMagF+OB431vpwgGvulU/hQPiPBL/ZMDYDxomespN9AI9h8j9n18kZ+A43GfpC4L2oP6i4fx5ni/FIY71NPSdAYOXxYgmufecYFjdHVE09IcMgqPBxrhUcGifXGi67wjHAtGqMriDeCUeFaBMPA08dqoBbBmDEMqDVq8QNG0NiuMzenIYTFwnfo+jHj4cDl8cLTdNV3HHFfeQhrR4QwQtjXlYbPKEIYIVwJ7ovagxHCCGFPMGYMI0IYwvaA79CKiSC1sLrA17b0dTh4uW+w6q7qxnVJCGtKhDBC2NeVhs8oQhghXAnui9qDEcIIYU8wZgwjQhjC9oDv0ArYkZElU1XS1+Hg5b5BWetbNkON65IQ1pQIYYSwrysNn1GEMEK4EtwXtQcjhBHCnmDMGEaEMITtAd+hFbCjyde6sKSzvCxsP5df0aalr6QEheXX+sKypKS9ZNKm/BrCmhIhjBD2daXhM4oQRghXgvui9mCEMELYE4wZw4gQhrA94Du0otOUpixsS/D5tRb6ta9x3aAGVX2Xd3aFayd0FoawRmDfP2YDDbBj1q35rl1NGXKaBnvx5lmNgs03GWMIO52nkR0a2qPkHe9oypx1lmQATlDPt0StTgF7pIrvSTijX0hQSxP7nAbgKSjjDmgVvvlNSQUehOVYHFiq0x8AP1G9L/5pnKHBbhv+4A3QCwPiu/KB4+FwSOzyce2oCeJGfoK4FjfCrx+1/kaYESTngQck998vgS6isfcljAoThNUgcDzMF43Rs19nnNeKG918s8Sf14rDbHFaMc6n3bNHUh9va4Jh2HBzGkJYLHyjVkw8qqUs7/vgv77W0QqdDdpCU14y5SWd5Z3ddhaGsEZECAt2RggjhBHCrkBUIoQRwghhCGFO8I1aMehU9Yf2K+hs1tLXoK+8xFwC0ACfWzoLQ1gjIoQFOyOEEcIIYVcgKhHCCGGEMIQwJ/hGrYAa1SrVaVn115bB8r5++i5sqqrBS8ryzjadhSGsERHCgp0RwghhhLArEJUIYYQwQhhCmBN8o1b0udbkszGrvlo0aykb9H2efOikrO28HOV1oSkJYU2JEBbsjBBGCCOEXYGoRAgjhBHCEMKc4Bu1YuJULXVt+Rlt2hIUtp9LprkQJSVoWX6uL+xs0FkbwgLQnTrdQ6EDgDGbb2KvpWru0Vh4Bqnu8tmz5USNXyugjXmO6Kiumh9KRl17gmaW1WgukowaxjskXA0MY+BXNz/ersE/jXGLo9C09aBUbE+xRUauuEKC7TU239gio/FHPyq58koJam+8UXLTTZJbbpGg9oYbJJgvBokJXnaZ5CMfkfzn/yy56CIJakc1HlX74Q9LLrlEglpIjg/mi9q9eyW1FJXBDwnXYtkRNIa24XeFWn8j/Orw28Av5/rrXXAtfsD4p6Hh5jSEsFj40hzJxnEnSN2qmVc/IUxPhHDqXX6EUIgQTk2EMEIYIey8UYQwhDCbEEacQpgLEcKpd/kRQiFCODURwghhhLDzRhHCEMJqhTD/Z7QQ5kiEcOpdfoRQiBBOTYQwQhgh7LxRhDCEsFohDCHMkQjh1Lv8CKEQIZyaCGGEMELYeaMIYQghQhjC+sOt6hiOkXBbbxvzqMz5Sc7AMN4iYeM3aE7RNOdqwPkadS3yMY26x4ACfVCjnK5pLixz4olNmXe+U9I0F0g4jBclqD1OQ8Mv1PHVWDiFfRIVszPPlDSnavCro9RdIcG/hV2aN2gA18qyU4Od6yzBph/76X37JNA2ZP9+Cc6ZhAGiFgda4uRMnKuJ+PNL/VmgOO3TX+tvdPCgBI1xfqk/zhTXoucHH5TgSFIcWIprcWAp1hnDwPRxyiiOFUVX/glighjzo49KHntM8sgjEjRG/PGt7bJ0Bmul0+fmNISwWPiWDCEsGmyCR6G7bcqVbRwhjBD2wilECKdOhDBC2CZCWCZCGMIGhm/Jisn/XHDyvxjM5/X9HLYo2ASP4pgIYcn5EcIIYc8jU3ZGCPsDu0BthLBMhDBCGMKWgG/JEMKiwSZ4FLrbplzZxhHCCGEvnEKEcOpECCOEbSKEZSKEIWxg+JYMISwabIJHobttypVtHCGMEPbCKUQIp06EMELYJkJYJkIYwgaGb8kQwqLBRtbvepuLJdy4K6dpwBs1A/tpVSBs3JvbNeCwBLv8AWCt4HzNbslSIxmYIG6kNkWN8dyrsYzr2XKSZhzfk7RWOQnZr/Gcp1FGTf9kzQD6BP3Tx8Ydue02CdQL2nbzzRJoW60uZWBxMASMCo3vuENSz6IMekZXt98u8fOF4vrV8I0R3BeHrNZHXJaBll96qQsODsWRpOedJ/l3/07y678uQe0550j+w39w+dCHJBdeKPmt35LgGFXU+iNYL75Ygtp6fcrg/FIEB5bi7FM8FP0xcHMaQlgsfC0qyxa2DiGsBmxVI4RChHBqIoRChLA/EcIyEcIIYQjbHr4WFSqgwtZdTNm+bNa27CwMYcuBrWqEUIgQTk2EUIgQ9idCWCZCGCEMYdvD16ICJQNs3UXbzLfvrO0sDGHLga1qhFCIEE5NhFCIEPYnQlgmQhghDGHbw9eiogJI2LoCbSZfpymc0FkYwpYDW9UIoRAhnJoIoRAh7E+EsEyEMEIYwraHr0Wl1L8atq5Am/ar+VDSWRjClgOnMmIjS7SW+2l/LbCN2TPww1ADVF5+WVJdqz3r+aWVTGpjL8BQAt8VRwVUn45vJLNAb/muBKNCY9Tyd7VbY4Hw0/+BLh3gjF7RWKi4n5fskieIoyIrzpOcoqfX1id8lsFJodddJ6ltpAw0BtdefbUEO+Zrr5XAphAMEvE2hRtBzODDUFw09gIMx0Nj1OK+9dqWGbWS0FQsDpYON8KhslAgCBKMCMGY9+6V+Mb+t4EzSHEW6KFDEpwj+vDDEjTGKaOoxbU4vxT/RPVabk5DCIuF70yl1L8atq5Am/Zr54cSUxjCloMbd7u9HvAWfy2wjdkz8MOIEK4W6lOEMELYs+mPEJYZtZIRwjIRwhDCOgnh5DO+tp99YQhbDm7c7fZ6wFv8tcA2Zs/ADyNCuFqoTxHCCGHPpj9CWGbUSkYIy0QIQwjrJITmQ0lnYQhbDm7c7fZ6wFv8tcA2Zs/ADyNCuFqoTxHCCGHPpj9CWGbUSkYIy0QIQwhrLIRNj/LVhZ29dRaGsOXgxt1urwe8xV8LbGP2DPwwIoSrhfoUIYwQ9mz6I4RlRq1khLBMhDCEsBAhRHtcOPna2VtnYQhbHWxVFdoU0a35zkbCrbm9lnxB4/je9yRDnKvxqE5AgZr3aPREVjYWuLBUoD+TYGFngTfS1Ti2kdjfRoU+UDz9gR+D8jpN82WJ7YoLS34gocTCHv1htsoZGj79H0o+8QkJ9tOjggM8/XmeXr1wcCj0CQ4AifWe5sUMp4xCn3Bf1OK+aIxA2+BakKvLLpPgXE2cnOmP6LziCol3LTg87BHLjpXE4a4HDkiwznj6eEb4Mdx3nwQ/YNTef78EYgYhfOIJyeHDkk9+UvLMMxIYoI/aIzenIYTFwndoCGGdsZv+oe21OgC8xW7ceS2JEEYII4RTpJbACGFfIoQRwghhCBsDvkNDCOuM3fQPba/VAeAtduPOa0mEMEIYIZwitQRGCPsSIYwQRghD2BjwHRpCWGfspn9oe60OAG+xG3deSyKEEcII4RSpJTBC2JcIYYQwQhjCxoDv0BDCOmM3/UPba3UAeIvduPNaEiGMEEYIp0gtgRHCvkQII4QRwhA2BnyHhhAWzekaboLBLzR/owFf1+gmGPBER+GllyQVOmZrCE3zI43nbAmEYcAf3it5YyMhf6kBP9YAXVg/fUrdVzTKLhyF+k3NeRqwe82OFf2+ZhTXaACU/mcSXdgB1XyDxoNjGLGBRg4elEAI775bAiFELYQBDgC58url7QI6gWEg0Il77pHUDlwGZoL7YlQYs58CFgeNcZwpFtYHE4S0Q2Lhh5BJqOZHPiKBpn7oQ5LzzpO8612SX/1VybvfLXnf+yT/8T9Kdu+WXHSR5NJLXTAjTB+pT38tY/+ywM1pCGGx8LUYQlg0EULHEQ+MEEYII4QRwghhhDCEsDbwtRhCWDQRQscRD4wQRggjhBHCCGGEMISwNvC1GEJYNBFCxxEPjBBGCCOEEcIIYYQwhLA28LUYQlg0EULHEQ+MEEYII4QRwghhhDCEsDbwtRhCWGe8Tvha7wDY5R+n8Z42cF+Fh1LqcZcDYibs3CmpbGqMiQ3wPQkXR4FsvN6dX0ptO1YPDvWcIHnxRcksDNgUfipv06AWDwVPwf6hYY6ccIJkAAwSx13inEls+m+4QYJjJ+EtsBp/nqfXNngLamGecB40ru2rDE7O9JoKE4NN+VFhvrgRhgG78GeB4oTSK6+U4MBSOM/evRL8Nq66SoKTUdEVrkVwLXwJwS8Hi4PfJCTW/2LRFe6LWjx9jMr/vPHb0HBzGkJYLHxLhhDWGW81vjZCOP0gSYSwAD+VCGGEMEI4SYQwQhjCVoRvyXmzXMA6pa9lX3kIWxRvNb42Qjj9IEmEsAA/lQhhhDBCOEmEMEIYwlaEb8l501rcoM71tewrD2GL4q3G10YIpx8kiRAW4KcSIYwQRggniRBGCEPYivAtOVc61W76QlMewtbFW42vjRBOP0gSISzATyVCGCGMEE4SIYwQhrAV4VtyrvTpnPkwZXkI2we1KWVgW9/s0Vh0i3zaaZKm2Sfxyofd9i7JGWdIhgapymfV69xzJdWhowJ2fUPntQL0jGvxyFB7rkZPN7UTrNBh8Fo/yHPKjFyNP9LoybcchsAb1UfFTh+cIqs/0XPOacpUD0WBto2SulEbaO94OKLz4Yclhw9LHn1U8thjkscflzz1lOSJJyS40YMPSnDIKgwQE0SwOF5FxvgDg1FhnSGiuBa16ArBjwFOi98GfkioxbW4Ea7FwuJaTAGBliMHDkhwxiyCI3b9tfjlHDokeeSRMtychhAWC1+Lc6VP58yHKctD2D64jWyEsCRCqNf6QUYICyKEEcI26AqJEEYIQ9iK8LU4V4zOLR+hs6r82lcewvbBbWQjhCURQr3WDzJCWBAhjBC2QVdIhDBCGMJWhK/FudKnc+bDlOUhbB/cRjZCWBIh1Gv9ICOEBRHCCGEbdIVECCOEIWxF+FqcN51qN32hKQ9hm+A2shHCkgihXusHGSEsiBBGCNugKyRCGCEMYSvC1+K8WS5oS9Cg/YCWvjyErQIOaeSuF9t61Qlc63sGZ2oG7qu8XfMOTfOi5j2SpUYC/Jibz5f52c+aMlCCn/ykKVMNEtyq+b7kmEayZKeA81oHZnSRRsE6gx2aAYtTtYa0E+jTy5r9Gn+tPJSmOV+jP7OBtbK8WdM8qLFgqwojQh56SIJrIVdojKAxLO7ppyWQumeekXzykxJ/LQLVfPJJCUYFEYVbomdoKnrGtVhJ3BeNVSfYGAv7wAMSPFBoOWwKTosTO/3xnjgZFT6Mg1LR2J+q6g8s9Y0RHKKLrnB8K7wUM/K19XIV4eY0hLBY+FoMISwabIIHxCxCGCFcYUeEsCBCGCFsEyE0jSOEIYQKvhZDCIsGm+ABMYsQRghX2BEhLIgQRgjbRAhN4whhCKGCr8UQwqLBJnhAzCKEEcIVdkQICyKEEcI2EULTOEIYQqjgazGEsGiwCR4QswhhhHCFHRHCgghhhLBNhNA0jhCGECr4WgwhrDOna+hpur1+WyMh2JpbJeCNsOnXrvwgT5Ls3Cnhpt87gDciTMGDMet9y9OrXj3AShuzlmP2Jgb0KTQ3acDuMjt2NGUAD/D0j5tcUOYd72jK+INDh5DjTHmo7Lie9cdPcCMg4s2VxK4Xp19CCfwZlTj+EcFBmvUhliazXFsfy2mmgFp/X5yMilMovWlD2+B4CIRwVCCx0HKculk/tTKjTgpFbb3yZXxXCB4KgkHiB+x/3j5QPtwIQWN7Wi83pyGExcJ3ZghhnfGuFSEsGZAcBWPW+1L5tDFrOeYIoSFCWMTLlc8s19b6YaaAWn/fCGEZLA5q65Uv47tC8FAQDBI/YP/z9okQhrBF4TszhLDOeNeKEJYMSI6CMet9qXzamLUcc4TQECEs4uXKZ5Zra/0wU0Ctv2+EsAwWB7X1ypfxXSF4KAgGiR+w/3n7RAhD2KLwnRlCWGe8a0UISwYkR8GY9b5UPm3MWo45QmiIEBbxcuUzy7W1fpgpoNbfN0JYBouD2nrly/iuEDwUBIPED9j/vH0ihCFsUfjODCGsM961IoQlA5KjYMx6XyqfNmYtxxwhNEQIi3i58pnl2lo/zBRQ6+8bISyDxUFtvfJlfFcIHgqCQeIH7H/ePhHCELYofGeGEDYU1S5fOPdcCc9sxJGkMATuxX2t8lbNgBH52rMl/r5jqJZOlOCnP23KwPG++U3JuMXhU8D0N8hqXFzGr0Y1oy23Gn7neuutEux6sRfHtb6rUdtr7ONxLXr2jdHzLKMaFdwIgXvUl5fBIP2YR/Xsr63vVcY3xkPx8eeXojFqcbwnRuWPBkWwGvVP2gTPt25QhJvTEMJi4WuSLNusFa/+Cb6LvvIQtizcuSoRQkO1dBHCcjUihMVqYBPs97XYIkcIpw9uhMBb6svLYJB+zKN69tfW9yrjG+Oh+EQIQwgLhK9JsmwzGm90bW1fs75yw2v/H15dhb6qLMGHEBYHd65KhNBQLV2EsFyNCGGxGtgE+30ttsgRwumDGyHwlvryMhikH/Oonv219b3K+MZ4KD4RwhDCAuFrkizbrBV96tVXbqitz3zt/Fx/CGFxcOeqRAgN1dJFCMvViBAWq4FNsN/XYoscIZw+uBECb6kvL4NB+jGP6tlfW9+rjG+Mh+ITIQwhLBC+JsmyjaPTu2BcsLVSvUrqBmjTFoK2qq+TksHyvgYhrCHcuSoRQkO1dBHCcjUihMVqYBPs97XYIkcIpw9uhMBb6svLYJB+zKN69tfW9yrjG+Oh+EQIQwgLhK9JsmzjgD5NvnbKVV1Yah4+dxa2n0F9IT6XDJb3NQhhRsZszc/UbL2teXNJGb8aF14o2Xar0fxC48f8cc2otfI9K0uagWtHrOSb3yzhybcWLuzrNNX2VII9sd/m1kZhrsVOHbX+Wp/61vPqCmP2PXu7QONZVqN+aia+ZzT2B4f64I8Fo8aMxlhJ39jPCEFjH9zIZ8zT5+Y0hLBY+NYkyzYD1CpVfyjpq63L+xoA076lLCyaHKWvkxDmRYRwagXS1YgQRggjhN2pbz2vriKE0ydCOPXT5+Y0hLBY+NYkyzYD1CoFAetTMqhXXd5e23K09Qoo7GzTdHUOBhuEMCMRwqkVSFcjQhghjBB2p771vLqKEE6fCOHUT5+b0xDCYuFbkyzbDFCrVKdT1bV9Lld/MCxXsMUR2vJVNwhhRiKEUyuQrkaEMEIYIexOfet5dRUhnD4RwqmfPjenIYTFwrcmWbYZBibWKVd1YXkVPteFZXkJCutO6q+dn+sPIcyXCOHUCqSrESGMEEYIu1Pfel5dRQinT4Rw6qfPzWkIYbHwrUmWbYYx5jap6qxtq/oaoE1bWNayqKd/bTIwqrYwhDmyp8zQpl+46y7JyF3+K9aIPL7xiF0++MEPJH7TP7DLby4tM7Swfkb2vFbiF1ZG1ZzeSMasVXUjYegEWo9dnIFB7tPcXgY75Ka5SaOLg65ObSTHaQb4K80eSb3x7d+5Mn6njuBa3GhUV4h3Dx/fFYLGvqtRK4lrfVd1gzLoGSd2IjixE4dw+lrfFYJR4T/fd98tueceyf33Sx58UPLAA5KDByUPPSR57LEReeQRycMPSw4dktx3n+TeeyWYkc6Xm9MQwmLRN2YIYR3YEyFsiRBOv1bVjYQIoRIh7I/vCkFj39WolcS1vqu6QRn0XEugsbgIYYQwhO2HvjFDCOvAnghhS4Rw+rWqbiRECJUIYX98Vwga+65GrSSu9V3VDcqg51oCjcVFCCOEIWw/9I0ZQlgH9kQIWyKE069VdSMhQqhECPvju0LQ2Hc1aiVxre+qblAGPdcSaCwuQhghDGH7oW/MEMI6sCdC2BIhnH6tqhsJEUIlQtgf3xWCxr6rUSuJa31XdYMy6LmWQGNxEcIIYQjbD31jhhDWmx07JEO1XmMU+tKYWs+bNHCPExoJ2S3xsnGyRnnveyWUDfR8jIbs14zBT4FrZYEC7dCQ58v84hdNGYCNXLOEo0HBj8tcdFFThqNaQlfnSU7Ro2L9WjW3lqH/+2uX3Ix27ZLwJEkEG3e/j4eZYBPsr7U7ZubjH3fBjbxq4mxMeEt9eGYZ3NefyYmeoZpojPn6pbvzTgkmeOCABPoEufLBtbVBlXn0Ucnhw5InnpA8+aQEjdEVAk/DIFGLG+G/BY8/LkGtd0vcCF1hvlrLzWkIYbHwNRlCWF8q5fO1EcKjRAgjhEdZcjOKEEYII4QRwhBCC1+TIYT1pVI+XxshPEqEMEJ4lCU3owhhhDBCGCEMIbTwNRlCWF8q5fO1EcKjRAgjhEdZcjOKEEYII4QRwhBCC1+TIYT1pVI+XxshPEqEMEJ4lCU3owhhhDBCGCEMIbTwNRlCWDQ7sMv3jqfnWw7YxeRkzjbCCy9IKnDtkWMej+aKMhdc0JThpl95+WUJOVYzwBzX6mcaYedOyRBYKwxSlo6DHMcvzAm0fIKcvko7EQNsmqs0qFXeoGmulfDvDrslZzQSwCmA/Rosu64GwDYXJzp+4hMSnJ0IBarPliyzb5/EH2h5880SXFuflmly/fWSj35Ucs01kmuvlVx9tQTXXnedix8zRoXVwDAwyMsvl1x5peSqq1zQFcaMpwCJxeOGD0NTYfj4IeFaWCtu5OXZDwNBzz64Fj9+3Pegnm6KYPp6JCk3pyGExcLXIli2WT+Wl7tv31cewgYmQlgSIRxBhLBkf4SwNxHCCGEb9OyDayOEIWxR+FoEtQSWGWIVeuYvaWv7mvWVG5aP0Fnoq8oSfAhhDBHCkgjhCCKEJfsjhL2JEEYI26BnH1wbIQxhi8LXIli2WT/61Kuv3FBbn/na+bn+EMIYIoQlEcIRRAhL9kcIexMhjBC2Qc8+uDZCGMIWha9FMBG/vgwBU5qoV58+tW3KkrJ9WdtW9TVAm7YQtFV9nZQMlvc1CMESISyJEI4gQliyP0LYmwhhhLANevbBtRHCELYofC2CZZshSlOqjQv6hMK6PT70fe4sbD+D+kJ8Lhks72sQgke3qtxPW3Zp/I759TiV8bBGTnTktcdrlOrsUwWnjJ7sTgolmCC5QELZ8OyR2Gu/8x1JhT5BrPO7NAMWB+QZDawzPfz7mns1YI6Nzy1THf26drX6FE7VA1phnsBuVbmtx3GX2Kkj0IlbbpHg8E/sxeveytQb/ek3/X6QEDN4KWrhhz7wQ6iXPwoVg8SoIEhYZ1yLnjEqNPbXYtnx24AvwaZggGiM3yQOO/XneeIcUR+cI/rIIxLU4m8l+JeC4KEgurDcnIYQFgtfi2DZZog+U6rLzYeSvtq6vK8BMO1bysKiyVH6OglhSiKE/WCCJEJYECGMEEYII4QRwhDCePhaBMs2Q/SZUl1ef5h87lOyaToER1uvgMLONk1X52CwQQieCGE/mCCJEBZECCOEEcIIYYQwhDAevhbBss0QfaZUl9cfSura6Ts0LFewxRHa8lU3CMETIewHEyQRwoIIYYQwQhghjBCGEMbD1yJYthmiz5TKrzCxzkvqwvIqfK4Ly/ISFNad1F87P9cfQhhFhLAfTJBECAsihBHCCGGEMEIYQhgPX4tg2WaIPlOCVnVaVlvVWdtW9TVAm7awrGVRT//aZGBUbWEIc8KKSsUXNAqF0DFwFqh2hX1d03xFMk5TwStlPve5pgyPytQbcQrWtNmYZ1R6rtUo9DTHBz8oaXZq2NU+jeKXvdkr2YGjbh3VWil8oNYted+7NAp7VtiVTvCYRnKKBpJTn9JZxh9oCQW69FLJnj2Syy6T+NMvMQwYERQIgWxAcVsnmQSNETgPVPPOOyVekEYpLrrCjbw9YjVgnhgGevbrjFH5MUMIvcRikDiR1R8bi5/ZFVe44FeHw11hy/iXgjHjKeDFgGhX3JyGEBYLX6khhI1FhDBC2IZdRQgL2JVOMEJYJkIYIYwQhhAK+EoNIWwsIoQRwjbsKkJYwK50ghHCMhHCCGGEMIRQwFdqCGFjESGMELZhVxHCAnalE4wQlokQRggjhCGEAr5SQwgbiwhhhLANu4oQFrArnWCEsEyEMEIYIQwhFPCVGkJYNAPK92XNByRegcahPY8C54g292m+IzmjkWCnTlT5qAS73dGR4CRNc79GBvncc00Zf8jqSy9JiBVRwkHq0ulqPP98U6ZCl84Dm3qnBrWna5ofaoAdBh+o570aBYM8U+P1GPvaWgJNIIQ+cLyrr5ZcfrnEXwudQGAmXp+8iiBwLfgSFgc6YZWAQWOM2TceFQwSq4EJ1peXwbUYJFbSqyYCa0XPqPU946eCrrDOCJ4+ZlS3L4P76m+Sm9MQwmLhazGEsGgihBHCFg4yQlgSIYwQrsQ3HpUIYZla5MpECEPYovC1GEJYNBHCCGELBxkhLIkQRghX4huPSoSwTC1yZSKEIWxR+FoMISyaCGGEsIWDjBCWRAgjhCvxjUclQlimFrkyEcIQtih8LYYQFk2EMELYwkFGCEsihBHClfjGoxIhLFOLXJkIYQhbFL4WQwiLpj1DchLlr/5KUvFymWOPbco0SxqADXRzaxm895sTNXqE48UXN2Wq0y8/WIYHaR6nUXCEIRtzly+rwb6aL2l+JsFqLNml89iFZWOCxj+VwNO4zo9I7MKyK9/4jZpmvwZgnf15rddrfM/KGRre6Bsa2zOO2Xz0UZfHH5d88pOSZ5+VfOpTEtR+9rOSZ56RPPmkBDf69KcluBEaP/WUBDd6+mkXDOPwYQnui+BGGEZ9L3NfPAUMA9dinTEMLI4fM3rGff2PAdc+8YQL5vvII5JDh1weeECC001rNysDXcR/+n1jiOiortQPuTkNISwWvhaV5WWXEMI8iBD2q0iEMELYyxkRwghhhDBCGEKYA3wtKrUEbhAhXD5CZ6GvKkvwIYR1IkLYryIRwghhL2dECCOEEcIIYQhhDvC1qNQSuGGF0Hzt/Fx/CGGdiBD2q0iEMELYyxkRwghhhDBCGEKYA3wtKrUElhlk4loTeauFrS6ffK7LQVtVX1szWN7XIIRFESHsV5EIYYSwlzMihBHCCGGEMIQwB/haVGCAyCDwutLBBj9PvrafS8r2dSEYLO9rEML68Kd/Kqm2ucKFF0r8rvdtb5P4nr/xDYnvueK/aZRxdqG8XWOnUB126qgOaPU9/0gzZgq25127JCN7fkWDG71HMnC8pzg8K8mfaX6h8WCQ12r+XuOWjhyv8Wf5YquKbS5qsc31m2Cf+gxPcwqlP9ERPfudOrpCLeKPrMQxm2iMYJDoCjNC6oGVGTV91EKfPv5xyb33Sj7xCYmvRVf33CNRI2IwSATzxV/O/KGyuNbX+nXGtf4HbI+c5eY0hLBY+FpUSv2rMwhcq8/BBsuBad9SFhZNjtLXSQjrTITQESF0tCo4CW4UIYwQrgRdoRbBMFAbITS1EcIyEcIQNjB8LSql/tUZpBa2VZe3mtfXBvT12TLYIIT1IULoiBA6Jh7YBjeKEEYIV4KuUItgGKiNEJraCGGZCGEIGxi+FpXW/TozSJ+8jS1HIWCLI7Tlq24QwvoQIXRECB2lDb5S3ShCGCFcCbpCLYJhoDZCaGojhGUihCFsYPhaVGCAyCBwrdLB+j5PPnR+7Syc5trOz/WHEDYEEUJHhNDxSoTwKBHCMhgkukItgmGgNkJoaiOEZSKEIWxg+FpUJuLXl0G8pLV0Nqi/dpaUhZ19oqoswYcQ1osRu97KAEsBeGVol79PI1x6qWRgAw0GGp9X5oILmjLNLskvfiGp0PmCUaqJMyoxhTfh/FIB2x7/yH70I8nQMwJ2vsoll0j4uPW+1em1P5RwkL7Ws/prq3UW9u6V+Kdw7rmSpvmABDtXbHNH+QNqEWzc777bBT3fd5/k4EHJ/fdLYCa+FlbjbwSrwYxgNVhYPFEEXeFGWA2slR8VnqBXL+88aDzqRv7HgMY+tRKXwZhxLe47qjEm6K+Fl6JWx8zNaQhhseClGUJYPBHCCGEfdr5KhNA8hQihq40QlokQmsaYoL82QhjC5gEvzRDC4okQRgj7sPNVIoTmKUQIXW2EsEyE0DTGBP21EcIQNg94aYYQFk+EMELYh52vEiE0TyFC6GojhGUihKYxJuivjRCGsHnASzOEsHgihBHCPux8lQiheQoRQlcbISwTITSNMUF/bYQwhM0DXpohhIVjt8jcyNrG1QbabZGbd2hszxUjRHQtR/UdzfYe1QCrH1XTnK1Rx6M82zE3F0lOaSTHanBg6cAgFf9HCtwI29xRu140xgYae2K/vfbx9x2VOXY1x8wyKjwjSJ13vLqBaTzqWswIQVd1AxO4JWwZ8Y3xm6z/MFHG/7yh5QcOSFCrf4bg5jSEsFj4lgwhLBq7zY0Qmp5nkZwtOKoBVj+qCKHbuKOx3zGjtr6Xib/vqMyxqzlmllGN8rRZGo+6FjNC0FXdwMQ7XoQwhDASviVDCIvGbnMjhKbnWSRnC45qgNWPKkLoNu5o7HfMqK3vZeLvOypz7GqOmWVUozxtlsajrsWMEHRVNzDxjhchDCGMhG/JEMKisdvcCKHpeRbJ2YKjGmD1o4oQuo07GvsdM2rre5n4+47KHLuaY2YZ1ShPm6XxqGsxIwRd1Q1MvONFCEMII+FbMoSwaOw2N0Joep5FcrbgqAZY/agihG7jjsZ+x4za+l4m/r6jMseu5phZRjXK02ZpPOpazAhBV3UDE+94EcIQwkj4lgwhLJhR5z3SD/2ut7lPoz0DbuuBnsro0a44ZnQ1apevPb/8soRwRlZUuJI/0oDrNe6ReY49VoITWSsTe6/mXI0wcCDtAHrfUxvJLo2uxqU4rpZn2+owIIRKdY4osD2PeQp+q8r9NLbIaIyu/G4b12Knjlp/NChqR8V3hRlhl4/gWswX55fivpg+rsVK4qHATKCLuBZyhWvRMxqjq1pNTUbdCNPHtVirg3oSrD8n9oEHJLgRevY/BjxB/+PHfPVG3JyGEBYLX4ubja8egaUj6euhLe9r0DKXYYRtSoRwxMZde44QRgh7ex7zFLiRxTYXG1lsoEftif212IujFltzXzsqvivMqJbACOGUGXUjTB/XYq2gfBHCEMJI+FqsmKhOCVsogw3my6jb9TUeLO9rUDJNmxA6iBCO2LhrzxHCCGFvz2OeAjey2OZiI4sN9Kg9sb8We3HUYmvua0fFd4UZ1RIYIZwyo26E6eNarBWUL0IYQhgJX4sVYz1nbPsZmcvt+jqJEIZFECEcsXHXniOEEcLensc8BW5ksc3FRhYb6FF7Yn8t9uKoxdbc146K7wozqiUwQjhlRt0I08e1WCsoX4QwhDASvhYr+jxnUv7VFdrCuqQt72uDwra8bFB/rUuKDl4tLz+3DcrPJb68r0Fb2FahJIRhIoQjNu7ac4QwQtjb85inwI0strnYyGIDPWpP7K/FXhy12Jr72lHxXWFGtQRGCKfMqBth+rgWawXlixCGEEbC12JFn+TAiNrPaF83K1v6z21JW15+rUvKr52fyw9jP3cWtp/bkvJrCFPx0ksS7mvJX2jm5g+876j99A6NHdUrrzRlxo3K8sQTEl47akYDaM+USeji32uslxKV5wGwVriRjmoiYG1GPYUxK3nWWZLqtyHwbwenajhBgL934MdvVxJWgz0xtrl+T4xrsY9H4ADwB1/rG/ujMkf1jKNvb7lF4m/ka33jeiTTB4O88UYJZuQHiZ6xdPUsyvjG6Bm1fp0RzGjUmCGECH7eUE38W8CPHwaI+2q4OQ0hLBa+Fism2lPSlqOZL/dfB8vRYELfVX2f6w9jy/sadH4NYSoihCNGZYkQaiKEZexKRghNIoRlsHT1LMr4xugZtX6dkQhhCGE2+Fqs6JOcPhfqK/dfB8vRYELfVX2f6w9jy79a8VpTbRbCCCKEI0ZliRBqIoRl7EpGCE0ihGWwdPUsyvjG6Bm1fp2RCGEIYTb4Wqzok5w+F+or91/7ytvPaDBh8Cp8rj+MLUcD4GtD6CZCOGJUlgihJkJYxq5khNAkQlgGS1fPooxvjJ5R69cZiRCGEGaDr8WKPskZdKe+r2XLwc/1V4CW/nP5YeznurAsx+cQRhAhHDEqS4RQEyEsY1cyQmgSISyDpatnUcY3Rs+o9euMRAhDCLPB12LFRIFK2nI0az+YZpMStEFhWd7WoqSlrBr8jMISX97XoC2clJdfQ5gebGRH4a792tcklSF8Q6O7bR7RaUHjXTiFUlnS2PM8aQhUgn0aazVUIOWdGqLrjPmepPHuMRPf14yBg/SMmAI9fNQv5zQNkQf63vc2ZfyNvvUtCWeE+/rNNzavkDocpeiFsN5wl/H7aTTGfbHpx33RFW6E4Ea41jsAanGtH5UXJEjdvn2Sa6+VXHed5KqrJJdcIvnN35Ts3i15//sl55wjec97JOefL8FRvx/+sATDuOIKCcaM6eMXi0d2UI8Vfeghyf33Sx58UIJaf8ooniCGgTFff71Ep8DNaQhhsfAluk54mzK1tZitCxtkGGGT4qRuCHdthFCIEEYII4ST4EYIboRrI4QRwr7ni2FECEPYPPAluk4YmzJVIWwNnNQN4a6NEAoRwghhhHAS3AjBjXBthDBC2Pd8MYwIYQibB75E14lO68v/2S1sE5zUDeGujRAKEcIIYYRwEtwIwY1wbYQwQtj3fDGMCGEImwe+REMIC8dJ3RDu2gihECGMEEYIJ8GNENwI10YII4R9zxfDiBCGsHngSzSEsGhO19BMdCNrN8HkdTj9Elyq+YVk4FoAf3hJ8tZGcqqGN4LyAa3Vrl5+WQJ8bXVy5o81ezTCn/+5pHpG+ySwZWgqrVWPBlWp43mtuO8bNcdpmt0STH+H5ngNHxnAj0H40Y8kmO8PfiAZ8PDm8xLUsvG9GgUGCDPBNhfnLvot8k03SW64QYItMjbQcDzcCCejohanQWLMDzwgeeQRyWOPSQ4flhw6JIEw+PNavTxjvgh6hlti+rAazBe18CVM/8knJVgN/Dnk4YclWFjcyNeWRvcPwfQhhF4X/c/b/2UBzwg/JNT6HwOu1XBzGkJYLHwthhAWTYRQbhQhjBBGCCOEVdBzhDBCGEKYH3wtVkz+h3yT/y1fPq/v57BFiRDKjSKEEcIIYYSwCnqOEEYIQwjzg6/FEMKiiRDKjSKEEcIIYYSwCnqOEEYIQwjzg6/FEMKiiRDKjSKEEcIIYYSwCnqOEEYIQwjzg6/FEMKi4c71Io1CXbRQcvQ8T2z6MYwzNNhPv6GR7NSgKyiQSt1JJzVlKtlQA8R9Udt8T4L7cp2Fl16SEKzkCRpwrAaLs2b89KcSwqUTfv5zCcFPBT8k9IzGFFHliAcWAnyeZNSyn6xBz3j6CDayCDav2ObCTHAtdswIrsVeHBt3bOuxj0dXCJwWgU3BTGBTCPzwoGoMgunjvnBpWA3kGceKwrRRi2txBimuvflmCZQeT2GUa9Urb54Cgl+dd9pHH5U8/rgExotaKK4XYHQFH8a1aKw+zM1pCGGxyPu05pd/2WWBLB+BpZuKLTCFsDZQVCKEEcLVECGMEPam1g+jIhHCCGGEMIRthrxPa2oJHCmEEwvyLjRlGxbNG9yi/dpXvgpmuTZsXSgqEcII4WqIEEYIe1Prh1GRCGGEMEIYwjZD3qc1tQSOF0J8AGW5ccK+8jnSd4u+8lUwx67CFoKiEiGMEK6GCGGEsDe1fhgViRBGCCOEIWwz5H1aU0vgGCFcxf9trbNNZz+lPU4+lyUoLMtRZUpMed9VbYO6vKwNoYCiEiGMEK6GCGGEsDe1fhgViRBGCCOEIWwz5H1aU0vgxhDCsqT8OuPnyQd8NeWDnydf28/11xAabq/f3EggOc13NcrEfNpYBeJuG+G1r2hGcb9mzVjSqBK85S0SHu6K6Xu4OMCu1bs0sEd/qCxt2fI2DcB8vWv5I0kH2CfZURljGb90YOAp2JXEvyNsZBFsr3Ujy8bYmnsjghLcdpsEonL11ZLf/E3JhRdKfuM3JOedJznnHMm73iU5+2zJ+94nwY0++lEJxgybgiBhNeA8iBdRiAoeGU4KfeopCWrRFQJ9wo3gafhTAox33z6JX8n9+yX42wF+SPirBFYSJ9DiFwuLe+YZl2efdfEi+vTTZbg5DSEsFr5CQS2BaymEfQ18P31fN1p559cQmgjh3FjSHPHACGGEsGMlI4QRwghhhDCEsAJfoaCWwDUTQlPr+1mu6GvWfgBogK/zKu/8GkITIZwbS5ojHhghjBB2rGSEMEIYIYwQhhBW4CsU1BK4NkJoqpqq1n9t6Ws2Y/tVl3d+DaGJEM6NJc0RD4wQRgg7VjJCGCGMEEYIQwgr8BUKagkcI4RNjyatwpH85Z21ZXnf58lXfJi+vO/z5EP9FVUhTIgQzoklzREPjBBGCDtWMkIYIYwQRghDCCvwFQpqCRwvhC1lYWeDCW1VSVlet+m8vCwsy1FVF7ZffXlZhcL2M76iKoQJutsG3MiC/RrdBNMe7Y2aw5o/lcABjtc0ezWOU06RNDvtIZxQoFM1gKLyvEZ5q8YP4xgNZHIUu8ZI+yx4e0TtSRryyghPw1rhN4lntKQ5S4PFwdIhzd9rLG/UwBB0q8parxPYBH/qUxLsmD/7WYnvGcH2GmYCjYHEIjAEaJs/ChXO48/GRA6qLcOmYIDwFgiht/QHH5RgvtAnzAiBemGtfC0WB9P3o0JjzAjxQoh19suOYBi4Fr9JPCM8QX1k3JyGEBYL35IbFUjXNIxtv9asYgphm7DbeRr2xGR/hPAoGGSEMELYR4SwTIQwQti37BHCELYHfEtuIWJfYbOw23ka9sRkf4TwKBhkhDBC2EeEsEyEMELYt+wRwhC2B3xLbiEihGGzsNt5GvbEZH+E8CgYZIQwQthHhLBMhDBC2LfsEcIQtgd8S4YQFs5u52nYE5P9EcKjYJARwghhHxHCMhHCCGHfskcIQ9ge8C0ZQlg4e6e3KeynKVfci4OPaTyQSeUNGuCHsVOzA+dMrh1flmAYgKO6VQPxVt6lAejZaxugPb5HMwN+NXhfAQdYovH550sG/ipBxwP6RwryosbBMWM/7XUC+1o0hpl4jTlot9fY1kMYcC0GiRv5KaAxDv/E2ac4OBS1t9wiufFGyfXXS1CLUzevu06C+958s+TWWyUY1e23S6BtCK7FIHH4JwaJCV5zjeTaayXoCqfIomcMA6uBZfer4Z8vusLppnhGmAJqsRqYkZ6qys1pCGGx8DUZQlg4eyOEEcII4atECCOEEcIIYQhh4fA1GUJYOHsjhBHCCOGrRAgjhBHCCGEIYeHwNRlCWDh7I4QRwgjhq0QII4QRwghhCGHh8DUZQlg4eyOEEcII4atECCOEEcIIYQhh4fA1GUJYNNxt367RDTT9QU9WpMZ4fM/grzWev9TojYBXET/B4zWnujNITzxRQrzENhdogMgzdkHV87Wr0Twr4ah0Nd7WSMiDmj0ahYN8WSOnjJ50UmNS/YAtuC/n+ydlcIThAKdodAonn9yUaa68UoJ9vN/0w0y85KDnq66SYBjI5ZdL4A8YFW6EoDHsAg4AQ8Apo/5IUhzRCRH1gcRCvHH6JVwatuyPyjxwwAUzgj36+eJGGAZ+0PhTAmpxbCziu0JjHISL82kR9OxvhFp/aq4+UG5OQwiLhe9QUP+3scwCWT4CS8cz2Mm8bhTC1HAvHiEssROMEEYI+4gQmqBxhNAkQmjixxwhDGHzwHcoqP/bWGYKJn5lLKts0NemmULkpmSafqZpE8L84F48QlhiJxghjBD2ESE0QeMIoUmE0MSPOUIYwuaB71BQ/7exzBS0ctVnWX3lYMpmg0zTzzRtQpgf3ItHCEvsBCOEEcI+IoQmaBwhNIkQmvgxRwhD2DzwHQrq/zaWGQJm1SlanYWgbnPk/5r4Kp2Fprys6ixsq1ASwprBvXiEsMROMEIYIewjQmiCxhFCkwihiR9zhDCEzQPfoaD+b2OZIaBVnZZVWllng6a6sGxZfpjL57ak/BrCWgIT040sXuXcMfNURpx+ea1GOUGDrs7UsGeFh44e3XkfiefjGoHHqII3a/wg36hRlpYkzU5o6mc0josvljTHacCSxje2a9U035Ysac/juFfj+OAHJRUXajwj7osTd/ljwG8SD3RJc1A37jjPE28+OAAECcERjjj+0cskXAsqgjNIoSIIZuQFCXKF6aPne+6R3HWXBGuFMaNnTBCjqidVBueIYulwriaeEQaJZ4Se/UmhaIynD9PG0/da7n8M/in41cBD8c8Iy+5rMSrbmJvTEMJikddrDf79IkOMtaxazNpy87WzsJS9UeWdX0NYSyKE/ZITIVTcWkUII4S9iRBGCPtWo5ZA84yw7L42QhjC5kFerzX494sMsQrL6mwzTT99bUw56GwWwtoTIeyXnAih4tYqQhgh7E2EMELYtxq1BJpnhGX3tRHCEDYP8nqtwb9fZIhVWFZnm2n66WszZTnwtSHMlQhhv+RECBW3VhHCCGFvIoQRwr7VqCXQPCMsu6+NEIaweZDXaw3+/SJT0Clg5nOfifU1Kz+s+vPka+fnENaeCGG/5EQIFbdWEcIIYW8ihBHCvtWoJdA8Iyy7r40QhrB5kNdrDf79IlMw8S5jX5OvdRvQd0lnoSkvqzoLJ+Xl1xDWGOxcKVdWcprDmjEseWGYYWuuR0c++6ykeacGIor5oudTNDwbE8wwhSW7OPVjKsMZjcI+0KUZRuV/SPirhDb+/vebMk3ztGSHPdsWJ8HuHGXa9i8L+OMIGfP0sZHFjtnrBDbf6Aq16Ao7ZtTiWgTX4r6IvxEa1y/7MhAGqGZtFMYu6gamMTJqzJg+Urc31+K+OAoVLo1zU/HnPZyb6o/39LXIoUMSHO+J+JNCMQU0Ri3ui2C++svh5jSEsFj4Wtyo1Nq2RizsRiGsUO/dp9/He3/wLFm7GLWfhk1FCGVGo7APdGmGUfkfUoSwDHwJiRCWiRBGCCOEIWx++FoMISyaeu8+/T7e+4NnydrFqP00bCpCKDMahX2gSzOMyv+QIoRl4EtIhLBMhDBCGCEMYfPD12IIYdHUe/fp9/HeHzxL1i5G7adhUxFCmdEo7ANdmmFU/ocUISwDX0IihGUihBHCCGEImx++FkMIi6beu0+/j/f+4FmydjFqPw2bihDKjEZhH+jSDKPyP6QIYRn4EhIhLBMhjBBGCEPY/PC1GEJYNFARnpz5c825GgUHaaJnwP30eZKJzKyEp33ulOBoPfaM40yVE0+UNGdpOH3F9jww/WavRvwBx/I1zW6NsmQ9rflemRdeaMo0Z2h02SuLQ8aA1YBLL9kp1HpZhmMeAZ8+DdAKIf+lzIDf5fu9uK/FBvrxxyWoRdAzdAK1o4Jh1A3K+FHVwy6DlYQ94qhMmPYtt0jwbxKNcZ4nGkPq4MOIN0BYq29c6+WqUwuzCdYZQWNMAQ8FwcIiaIxjVK+7TrJ3bxluTkMIi4WvxRDCosFOndvcCGGEsC9jwGpECEsihCZ+VPWwy0QI55Xa+kxqCYwQhhAsfC2GEBYNdurc5kYII4R9GQNWI0JYEiE08aOqh10mQjiv1NZnUktghDCEYOFrMYSwaLBT5zY3Qhgh7MsYsBoRwpIIoYkfVT3sMhHCeaW2PpNaAiOEIQQLX4shhEWDnTq3uRHCCGFfxoDViBCWRAhN/KjqYZeJEM4rtfWZ1BIYIQwhWPhaDCEsHH/QojLLJninZmG1wDemps4AFAjssGdj+kF6EW3+XnJyIwGYL+XKGuBpGs8SlE8EuGz4KkvWD7GwXGc75iXbMzR1wDz1Rqc2Et/zcZoPf1hy8cWS//SfJGh82WWSSy+V6K63ufpqybXXSm64QbJvnwTba9Tu3y+56SbJjTdKfGOYGHLrrRKvXqiFeuHcVOjEnXdKoHyYAmoxSNRCJnEj76X46xeCCWL6GIaPN17U4kaYEQaJa9EYDwUzOnhQAtWs/yJQBkeSarg5DSEsFr40wf/8ny4LZPkILJ2BWXprr537qML2JEJYECE0zgMihBHCCGGE8I4IYQhhVvjSBLUEjhTCiTJ5cZqyDYtmY5YOy2tn6SeECRHCggihcR4QIYwQRggjhHdECEMIs8KXJqglcLwQ4gNA+ZTNZmeWDiOEYb5ECAsihMZ5QIQwQhghjBDeESEMIcwKX5qglsAxQjiN7K2uTUlfVWd5WdL3uW6M8rqq/BrCWCKEBRFC4zwgQhghjBBGCO+IEIYQZoUvTVBL4IYRws7PRxsVXzvb1B8mn/uu6vzclpRfQxiJd4/mYxoF+1rd9U5+rC1f/nJT5lULKsPd9j6NvS95pcxJJzVlZgLbegXzpXuchfNLFVqNYu/bNN+VwPG8qPiDNAf4uEZ/Kn6+SxpOcLc7VdUrH9EJ/sN/LcsQvxr234IdFX4bL77YlGkeeEBy//2SAwck8BbstrFFxn4avuRPsPRHR2JrjvM8MQVci/niWszXn5yJYeC+WCu/Ggh6RvxRmb4WzgNBQmOMGerl9QmuBbf0XWHpfHAtpuAbY5AYFRYH8Y1xXztfbk5DCIsFL01SS+C8hbDRNzXrjuD7Gbyqs8Gk0HfV14P/GsJIdkYIp4beImC+dJ6zrCBFCGWCuyOEEcII4avBmK3VsHGEsIydLzenIYTFgpcmqSVw3kI4e5vya/HCf5W6QUvZAIUlbTmama8hjGRnhHBq6C0C5kvnOcsKUoRQJrg7QhghjBC+GozZWg0bRwjL2PlycxpCWCx4aZJaAjewEE5ZXhb2XQJ8s76rQpiOnRHCqaG3CJgvnecsK0gRQpng7ghhhDBC+GowZms1bBwhLGPny81pCGGx4KVJagkcI4RNj5X1fa6/tuCSstu+W/g29YfJZ3yty/vahLBadkYIp4beImC+dJ6zrCBFCGWCuyOEEcII4avBmK3VsHGEsIydLzenIYTFgpcmqSVwvBC2lIVFk+42AJf3XVIWllV1Y/O5bozysgrNQhjPTo3u43fskLDxGZKvfU3y+c9LeC0yC9CJEzRv1KAxaWVgEuGllyS8UfOMZo9GoKbiQMvTNbDliQa3wZhh2l41364Z4H6N4y/+QtI052h+rAHv1YzgwAFJ05yrAS9rRnG9xoKHArCPhz7BiLDNxYTRFWohKl7MEDQ+dEiCMSPeD+EPCPwBx11ilw89xvR9z35hUQuNwbGiOJEVwVmv/nBXf14rVgPDgAGiFmuFWkwQroVrcebqFVdI9uyRXHKJ5EMfkrz//ZLzzpP82q9J3vEOyTvfKXnf+yS7d0t0GNychtDDaf/9/2zAYJDL/+//3nTha3GjUmrYxnEwyGEIq2KnJkIYIewlQlgSIYwQRggjhGF7UcvYRggGWevWxg9fi5uBOFjYWuzURAgjhL1ECEsihBHCCGGEMGwvahnbCMEga93a+OFrcTMQIQxbi52aCGGEsJcIYUmEMEIYIYwQhu1FLWMbIRhkrVsbP3wthhAWzU5NhDBC2EuEsCRCGCGMEEYIw/ailrGNEAyy1q2NH74WQwgL5ktfklT8XCNgM+bZu1cCfvITCRi40Vs1A7gZ/fznkpE8orGcpCGuK7+SzZkay1e+IiGnuhNK/TB8bcV5GsF3NfDbsFMAL7wgGVXr/X/g2iuvlMAQsDWHHz70kOSJJySf+pTk2Wcln/ykBLVPPy05fFjy5JOSZ56RoGeM6qmnJI89JkHjRx6RYL61uJaB1MFpH31U8vjjEkwfM/rMZySf/awLFgcriRthGFichx+WoDFmhGeEYBj+CX760yOCGeFxYxioxajwY8AE8dtAY0wBP2/9p1FvT5MkWWT4WgwhLJgIodRFCEusTflh+NqKCGGEMEIYIYwQJsk2DV+LIYQFEyGUughhibUpPwxfWxEhjBBGCCOEEcIk2abhazGEsGAihFIXISyxNuWH4WsrIoQRwghhhDBCmCTbNHwthhAWTIRQ6iKEJdam/DB8bUWEMEIYIYwQRgiTZJuGr8UQwvpSHQ4p+K35LLVgqPFhDXhQMwurFzMcrDiqlnjHs7V+kP5a4G3Z38jXNq/TgGMkO3dKyJIGHKsh6qU4+pVcIeE5orslmODxGmyC/QYau21/rRcG2AW6wn4a94VqotZfC/eoXaUMRoUZYb7QJzSGMPilQy2mgK6wkvjnDRHFIasHD0og/DgYFsaL+yK4r6/FmBGMCofZ4oRSHDqK4E84OL8Up7miFn8cQVe4FsGYNfX2NEmSRYYv2FDw1SOwdDqmvHCWW4StSYRQiRAeJUKoRAgjhBHCCGGSJHMIX7AVE2Np6Sv/ao/VdDboa7wK5thVjencVE3oa1CX1yVhWxMhVCKER4kQKisqGCGMEGIl8c87QhghTJLEhi/YCuhK+3UajZnl2imZY1c1s3Ted21dXpeEbU2EUIkQHiVCqBzxwAhhhDBCGCFMkmS28AVbMYvUdbb5akFb0pa3X1vKr5M2bUn7tSx5ral+nXxAy5ZJCUD55GvbvqydFLa0hWVV3XJS0paXX8O2JkKoRAiPEiFUrogQRggjhBHCJElmD1+wFX3qMo3D9LWp+yxL6tr2Q/kZH/zX8lp8RVULCtGs8/K+z5Ov+FDSWRi2K8dpBviyBBvokzXKD38oqfbT+yT/sO8voxxzjIQMOMBPNMrJbgoVT0gwZk5Q4GqAgSmMYZdmSYNa/BhQe4wGTx+NMQXUnqU5RXOyBrU4rxXxjTGMN2pQC8drXpDgcZ+uQVcQwnvuGREYwkGrEwcOSHAtanEt7otabM1vu01y++0SXwudQG65RXLzzZKbbpLggFbUwkxuvHH1wagwQeSuuySYvp8gav2MvJhhGN7E0BgGBRNDY/xy0DNUEz9gr6k4VvTQIQn8Hw6PU0b1JNh6e5okySLz2haln4nYtPSVf7VHaToboPGUX1E+oa8xvvaVd36d4NsM9jxl+YTOwrBdiRCWnOymUBEhjBBGCLuUz9fWEhghjBBGCJNkO+W1LUo/fa7SV27ok6Ipv3besa8xvtbloKydgMK+rzOWT+gsDNuVCGHJyW4KFRHCCGGEsEv5fG0tgRHCCGGEMEm2U17bovTT5yp95YY+KZrya+cd+xrja1+5wV8y2POU5RM6C8N2JUJYcrKbQkWEMEIYIexSPl9bS2CEMEIYIUyS7ZTXtij99LlKX3kJ2rRf+8rrr189QudnfKi/dravqyZf288lpk3Zc9/nyQd8RXlnSdjeRAhLTnZTqIgQRggjhF3K52trCYwQRggjhEmynfLaFqWfPl35agVbHKGzAUrKqrakbVDWluXTlLTlZYO2pGzZSVmFZqgqqRuUX9GsrArblddrjtGg9k2a5o8lO9R5cO0uDW6E7TUMoTlbgmux6ce2HltzDBJdoRZdYUaoxWo0F9ho4zNx2qfW6mqcfrqkWdKcqCEXaxxXXSUhWKtRf0pY0jR/ohGuuUbCH9IAH9AoY8Y8sOzN32mEv/s7CX+TdqvafPrTkt/+bQkaP/+85Hd+R/Lcc5LPfU6Crj7zGQmOBvUnhWIvjp06gqNBsemvzx01Z5CiK5yqiqNBH3pIgsaIHyQO8MQ5onDpffskUE3Uej/EtTBAXOt7hksjuPb66yV1+zIYJJwWPaMWNxp1X/SM6Kjq7WmSJIsMXpqhBOY2DatoP/aSsOWA5ECQUBshLINarAYNMEJYsKSJEEYI+1yrlsAIYYRwmvuiZ0RHVW9PkyRZZPDSDKugNbrYXVgVkBwIEmojhGVQi9WgAUYIC5Y0EcIIYZ9r1RIYIYwQTnNf9IzoqOrtaZIkiwxemmF1TFQwNhhWBSQHgoTaCGEZ1GI1aIARwoIlTYQwQtjnWrUERggjhNPcFz0jOqp6e5okySKDl2YIYeFAciBIqI0QlkEtVoMGGCEsWNJECCOEfa5VS2CEMEI4zX3RM6KjqrenSZIsMnhphhDWmR07JARCOGY//Za3SOh45JAERzgO8Lca5VTNGRrlDW+QcMxYDfJ9yQ7Vp1GcprFjBtQYHN/afEEDztF4dmuUcRbnoFx5jpP4n/c550jIEgxQ0edb/drBNRK/6fcO4K/1e3EEjes9dBncFyrig407dvn4A8BHPypB7ZVXSq64QoJaH1x77bUS/HXkuutcrr5agq7Q2NfWFlQG1yJ4oP5GeCiYL54C1so/FKwG7oueMUg/X/wI619pGaua9fY0SZJFhi/JEML64nfMVCDdbXuqLfLZGhAhLIgQFkQIJf5aNK4lMELYdy3cI0IYIUySZM3Cl2RF+b+Oy+f1/Ry2BX7HTAXS3ban2iKfrQERwoIIYUGEUOKvReNaAiOEfdfCPSKEEcIkSdYsfEmGENYXv2OmAulu21Ntkc/WgAhhQYSwIEIo8deicS2BEcK+a+EeEcIIYZIkaxa+JEMI64vfMVOBdLftqbbIZ2tAhLAgQlgQIZT4a9G4lsAIYd+1cI8IYYQwSZI1C1+SIYQNhlOCt75VUnGXZMnup5VKYz6jEb7zHckoTW2aH2rA/RpHNeazx9ij8k6J15iKw5Ilu+w7JNUUPifxU3izZoBvasCLkiU7BfIeiR9z8zeS4xuJ5/WaWfBihp167VdlvB+i8R13SG6/XXLrrS4YZO0qJn6njp7hD1AC6IRvDFHxjSE5aIxgcbDseChofNttEjyjUT1jnf21ePof+5gE1yL4qfiefXBfrAZ6xk8F08cvB06Lp3/ZZWXq7WmSJIsMX4tK+z9g64SttzHLy8ssCmFORAgjhBHCLiKEZWrrM4kQlokQRgiTZNuHr0WFCqiwdUWnJpWFywWdhWV53aCvvK6aUJfXJatjXv2EUBMhjBBGCLuIEJaprc8kQlgmQhghTJJtH74WFSqgwtYVtZuVJXWVL6+/9n2uv/YV1iWrY179hFATIYwQrsRPIUK4arwRRQiNtkUIy2Cd/bVezHAtEiFMkmSu4WtRoQIqbF1R6l9d0idRdbm5xFTV1G3KksnYJhRNpiovq/oK26q2MIRpiBBGCFfipxAhXDXeiCKERtsihGWwzv5aL2a4FokQJkky1/C1qFABFbauaC3IfK2py80lpqqmblNe3vd58gFfTfvBzyEI1UGaup8+sZGAN2rsOZOTX2ELapvmK5oRVBrzHQ1Q2YC2DeAmOHDfnZJqzO/V/JkG/ETjpH2IVyTqh57qlyPDOOGEpgw5U2MZ+rvD37pDZQf4bpkDB5oyANvLUfb47W9LCM5sxKmMcB7YlJcrbNzvukvy8Y9LsDW/+24JVge16Aq1d94pgRJANrwSoBaBIfjgWowKYuaHgSl4yUGgMXhkaIxhYMy4FqPyy44xozF+OXi+uK//IaExgh8wnoKvxYz8I9MJ1tvTJEkWGb4WFSqgwtYVkz1nu/PE18nnenda71TRQ8lgbyVlg5a2Ci3Lry2D7acsD+Eo1bZ+RQUjhB24CQ7cd0UFI4SvEiEsiRCW8QqEWqS2PhNci1FFCMtECJMkWcvwtahQARW2rih1qPx8tEWBaTBNFegsrwsxwpKyTV1eNii/onFZfrR1CCXVtn5FBSOEHbgJDtx3RQUjhK8SISyJEJbxCoRapLY+E1yLUUUIy0QIkyRZy/C1qFABFbauKHWo/Hy0RYFpME0V6CyvC03PE1De176vvKWvPIR6W7+ighHCDtwEB+67ooIRwleJEJZECMt4BUItUlufCa7FqCKEZSKESZKsZfhaVKiACltXdO05e91psLz+2ve5/tpXWN60szcUdrbv+zz5ig8hkGpbv6KCEcIO3AQH7ruighHCV4kQlkQIy3gFQi1SW58JrsWoIoRlIoRJkqxl+FpUqIAKW1d07Tk7FAu707KwLK8b9JXXVRPq8rKk7/KysKw62nqlti4vC9vPIYxBNaZygO+X+eIXmzIV6kv/cHkZ4o4VbZqfaywDU1hxodcCfqo5X+O5SiNUw1AGxixnYx461JQhOHNVex7FiSdK2DMYmII67UmNhMCWLadplLe8RTIS+THsGDj6VZX+mEYCsCf2+oRabL6xJ0awgfa7bWyg0RXkCrV+l4+dut+41yJXBtd6YUDg0ugZXfn7ohZTwH39fNEYzxcLO4vh41r8rtAYtT5+zKN+k1grBC6Na1FrG9fb0yRJFhm+FkMIG4uBbX2E0BAhNFOIEBZgx4ztdYTQBNfiRvUcy0QII4QrqbenSZIsMnwthhA2FgPb+gihIUJophAhLMCOGdvrCKEJrsWN6jmWiRBGCFdSb0+TJFlk+FoMIWwsBrb1EUJDhNBMIUJYgB0zttcRQhNcixvVcywTIYwQrqTeniZJssjwtRhC2FgMbOsjhIYIoZlChLAAO2ZsryOEJrgWN6rnWCZCGCFcSb09TZJkkeFrMYSwvuzaJZmF6iDN/0+zT3O2ZIced4lDKU/QoPFZGtQuaV6n2aXBtThlFMPgpv9CCUzs7RoAQcK1uBHU2s8XtQh6frPm9RosHWwZPb9D42tH9cyjbnXZfWPU+geKWlyLHzCWDl1hgt4Q/H4auoharzHXX+9y7bUSnH2KXHaZ5MorJXv3SnBgq6+9/HKJP4LVn9eKWn+ja66RYEaoRc/oyt8Ig/Q3Qi2uRXBfXItHhimMqsWNMGbMF135p4/GqPXrjOBG2nO9PU2SZJFptz8hhA1BhDBCeDSwmghhGVwbISwD9/Cbfl/r9SlCaIL74tpRyudrcSOMGfNFV/7pozFq/TojuJH2XG9PkyRZZNrtTwhhQxAhjBAeDawmQlgG10YIy8A9/Kbf13p9ihCa4L64dpTy+VrcCGPGfNGVf/pojFq/zghupD3X29MkSRaZdvsTQtgQRAgjhEcDq4kQlsG1EcIycA+/6fe1Xp8ihCa4L64dpXy+FjfCmDFfdOWfPhqj1q8zghtpz/X2NEmSRabd/oQQNgQRwgjh0cBqIoRlcG2EsAzcw2/6fa3XpwihCe6La0cpn6/FjTBmzBdd+aePxqj164zgRtpzvT1NkmSRabc/IYR1AvtabGRRCyVA7ekav/meJX5rjto3adD4OA1q36ZB7bEa1B6v8VYzy7KfqEHt2zWYEVQT16K2OUeC2ndY5cN9/RM8WYMbobb5ruaDZV54oSlTHViqMzqlkaBWe65q79Og9k81Wmu3qs2ll0pQu2ePBDv1j3xEcsklEvSMWvTsay++WIKeMUGMytdivpgglAC1UCC/sOjK1/op+HX28/XDwIzQlVeg2pHKwOLwpwT8kQLHiuJI0gMHJPfeK/nEJyT33SdBY/SMYSA4N9WPSodRb0+TJFlkGssBC1tvVJaXl1m0HmyQYYSNB/bis5hJhLDM8RHCIrivf4InRwj7vQW1EDMYEWTDi4pXPl8bISzj19nP1w8jQmgSIUySTZvG8pr59cDWPSyvME15W1hWdRaWdDaoP0xD3bguWR3z6idsObAXn8VMIoRljo8QFsF9/RM8OULY7y2ohZjBiCAbXlS88vnaCGEZv85+vn4YEUKTCGGSbNo0ltfMrwe27qK0oLGffWGJb+BrQd24Llkd8+onbDmwF5/FTCKEZY6PEBbBff0TPDlC2O8tqIWYwYggG15UvPL52ghhGb/Ofr5+GBFCkwhhkmzaNJbXzK8Htq7oU6C6vC2pq/oKSzobdPa5XNAWltTl01w+TXlZ1VfYVrWFYRuAvfgsZhIhLHN8hLAI7uuf4MkRwn5vQS3EDEYE2fCi4pXP10YIy/h19vP1w4gQmkQIk2TTprG8Zn49sHVFn9jU5W1JXdVXWNLZoO6zdK0+76oLOy/B58kHfDXtBz+HbcUHyuze3ZThzhWOp+zcKcG1b3pTU6ZpztXojc7UY0Wbi8r84AdNGR7+iWvVl/bvl/C+uhrNgCGcrfmgBrW49usSSN2pGvSsjb/+dUl1I/iSGhHW6jSN1von+Ja3NGWa5rwy2PVhgmedJaHEvkVSzVdM+z3vacpg6aprLyxT/fjV4XW+VVey7PyZ6RQ4yEcekTz2mOSppySf+pTks5+VfPrTks98RvLccy6/8zuS3/5tCRqjZwTDeP55Ccb87LMS3AhdPfOMxF+LtTp8WIJ1fuIJyZNPStD46aclftkxZgwSwVr93u9JPv95Cf7ggVp0hQf6uc9JMAxMAY1/93clGAbui98VrsWYfc/oygfzxag09fY0SZJFprGU+lfD1hV9elOXQ4paTGFJZwPzofNrW1jTVqFl+bVlsP2U5WH7ECEsEyGMEEYIu/bTXhgQDAP77wihCdYqQlimtj6TCGGSbJ40llL/ati6os9w6nIvRZ2FJZ0N6j6XK462XqEubEt4cdGys7xsUH5F47L8aOuwnYgQlokQRggjhF37aS8MCIaB/XeE0ARrFSEsU1ufSYQwSTZPGkupfzVsXdFnOHW5l6LOwpLOBnWfnc1A3WbwcpT3te8rb+krD1ueCGGZCGGEMELYtZ/2woBgGNh/RwhNsFYRwjK19ZlECJNk86SxlPpXw9ZdlJIz9rMvLOlsUAvY8hHqBiV14eDlKOxs3/d58hUfwnYjQlgmQhghjBB27ae9MCAYBvbfEUITrFWEsExtfSYRwiTZPGkspf7VsHUPE/+pbaezvG7WV1jS2aAtLGvbm3Ze0nR1Nc3lZWFZdbT1Sm1dXha2n8O2QnbM3MjCLnQf7/fE1JiBrblKXXOfRi9/ZyNpVK5e10iaFyRnNGWqYagvNT+V6LWV02rjdzUSzkgUF8cBQszoS2oXzZIGw9CHQhXRGXEYuNGZGvu4q4UVP6wGKatRSazcCFtEnm27S0LH87WnSKq/O+hvA9bKH7DmjfhLynsk2MjCl1CLDfR/+S8SrA4awy5efFHyhS9IvvhFyR/+ocvv/74LRoX4KYwaM+6LWlxbj9Nci2Bx/uAPJFgc1OJGmC/UC0/Q/xjwy4HjeXmGifllxyPDtRiknxGu9T8GPAWs83/9r5I/+iNJ/aMtUm9PkyRZZJoQwnoj+/gIYYQwQhgh7HCeag8tqYXKOA/ipzBqzLgvanFtPU5zLRIhLBMhTJJktjQhhPVG9vERwghhhDBC2OE81R5aUguVcR7ET2HUmHFf1OLaepzmWiRCWCZCmCTJbGlCCOuN7OMjhBHCCGGEsMN5qj20pBYq4zyIn8KoMeO+qMW19TjNtUiEsEyEMEmS2dKEENYb2cdHCCOEEcIIYYfzVHtoSS1UxnkQP4VRY8Z9UYtr63Gaa5EIYZkIYZIks6UJIawvlA3dmnNPTBO7VAJ/KJTm1TS3az7gzvNEV9x8X1ymOv0S23HRNh53qbKBswPhD6zVMyqrWum5inMedgUTo13ItZWJna/RYXBhRVSqrmQlWat/LGiaH2g82hg/hubrGvmJchiYIK5lzwA30q647MpxGl+7Q1P7RpkXdE+MYKdeX16m1p4ycADcCLXYuGPTj1Mc4R6IP5MT8Yes+sYYFU6h9GaCtYLV4Cl4qxmlT5igX1isJM4+9UehQhcRf61fdlyLnnGILs56ffxxCc56ffRRycMPuxw8KDlwoEy9PU2SZJHhSzOEsGAihGVoYhHCCGEbLrsSIYwQtokQRgiTJBkTvjRDCAsmQliGJhYhjBC24bIrEcIIYZsIYYQwSZIx4UszhLBgIoRlaGIRwghhGy67EiGMELaJEEYIkyQZE740QwgLJkJYhiYWIYwQtuGyKxHCCGGbCGGEMEmSMeFLM4SwaLA39TvXUbVELI6VxDd2tV/7mqTiXs0sfE0j7NwpATztcxaWNOQ+jfC610mG+DON8nrN6yR//dcSNOZfJd6gURM7/3xJ5WmHJW9qymDjSk7QoGfUgmM14CwNuOceyb33SvA3DNTi2rvvltx5p+S22yS33y659VYJThy++WaJr73pJskNN7hcc43kkkske/ZIPvIRCQ7GvewyyeWXu1x1leSKKyRXXim5+mrJRz8que46CWqvv16CxUFuuUVy//0SKNCTT0o++UkJTAwCDBFF4LReYlELXYQfQvkwo0OHJA88IMHPGz/gO+6Q3HWXBP9wIoRJspHC16Ky/D9cNiPLy8ssWksWfLuwOfFSN0stcRZX4Ru72gihEiGMEEYIuxIhNIkQJkmywPC1qNQSuAohXF6BFV2g2ZRXTU9nh3VhXbI65tVP2NJ4qZulljiLq/CNXW2EUIkQRggjhF2JEJpECJMkWWD4WlRqCRwrhKURTWNH07SZhc7+68K6ZHXMq5+wpfFSN0stcRZX4Ru72gihEiGMEEYIuxIhNIkQJkmywPC1qNQSOEoIax1qS5aVuhDtO2vbBnV5WViWo01fIS6p+5myvKzqK2yr2sKwzfBSN0stcRZX4Ru72gihEiGMEEYIuxIhNIkQJkmywPC1qNQSOF8h7Pw8+YCvpn15yTT9lOV9hZ394/PkA76a9oOfw3Zlp4ZcpJFzNSmEwPc8y7Vglq58re8ZoCtc+zYNe/6CBEbUvKJRTtGwZ6A+rI29xDbN9zUXaIC70SOPSIjKJIA+DDCwGp6/0VhO1Iy6L6TuYx+TeKmDTuzbJ4GZwGpgU1Cv3/otFzRGLr1UAotrha0zGBU8DTPCakAYDurBkrCLhx5ywW8UgcbgWrgHniBcGh7uJQcTRHAjWDp+G/gxYJ2h5R/6kOS88yS/9muSM8+U/NIvSc44Q/LLv+zyK7+y+vzrfy1597sl+je5enuaJMkiw9eiUkvgHIVwTctBX/u2sKatQsvya8tg+ynLw7bEG1GE0PQM0BWujRAWiRAKEcIyEcIIYYQwSbZZ+FpUagncREK4rNQNWurCsj0o29TlZYPyKxqX5Udbh22KN6IIoekZoCtcGyEsEiEUIoRlIoQRwghhkmyz8LWo1BK4WYRwyvK+Qt++qcr72veVt/SVh+2EN6IIoekZoCtcGyEsEiEUIoRlIoQRwghhkmyz8LWo1BI4SggbFR58LmWpT5z62kzTvizsLG+pCzvvhfKysLN93+fJV3wI2xhvRBFC0zNAV7g2QlgkQihECMtECCOEEcIk2Wbha1GpJXCsEDYrLgTzaQtRhZLOKhS2n/G1bNyWo31fYWc/aFYWllVHW6/U1uVlYfs5bFfs5nuA0zTkPnO+ZdN8RfPnmr/WfE3zYw1qX7H5puaLmms039X8keZpG0wBY8aoUPsdzY80f6x5VgNtU9Xk9NHVYxrMF8/ofg3G/HkNGmNx/lbzDc0TNp/RYJDgkOYFzfOar2u+rcEj+54GvKj5O8n73y+54AIJfAlHVsIBcCjls89KPvtZyXPPST7/ecnv6tGROKMSXfmecc4kDns9fFjy2GMS1CLo2Z+riVFhgi+8IHnxRcnv/Z4Llg7xjT/3OQkO8ETt889LUIsJ+rNAMcEvfEHy+7/vgsZ+rXAtGvtrUYuu0BgnoyJYK029PZ1X/uYP/p8kSQbDd+aiiAiFsEKEMEIYIYwQPhchjBBGCOefeuObJEkdvjMXRYQwhBUihBHCCGGE8LkIYYQwQjj/1BvfJEnq8J25KCKEIawQIYwQRggjhM9FCCOEEcL5p974JklSh+/MEMKiiRBGCCOEEcLnIoQRwgjh/FNvfJMkqcN3ZghhvcGOGZtg7HohDLgWeU4D1/pzzU80j2i+pXlQg8bf1PylBkqAoKvDGjgPbOrLGqzkX2l+pvkTDfQJg4TyYWExqh9oIJP/V4Nr8VCe0WCtvqX5W82XNFjJ72m+o8Fq/EiDX939mic0hzUAC4vp32f/3vF3Gjzfb0iwc8U2F/niFyXYmv/BH0j+8A8lqEWw2/Y38vv4ejteBuqFazEq3BfBIP21vtYHY/Zm4jXGT3+OwY0gov4J4lo09hPErw7PCMG1defmRqitV6AMfoSqx/X2NEmSRYav0BDCeoP99LcjhEXgDxHCMlirb0UII4Td8UaEUdVuVgaD9Nf6Wh+MGWuFKWBx0NhPf47BjSKEZSKESbKRwldoCGG9wX762xHCIvCHCGEZrNW3IoQRwu54I8Koajcrg0H6a32tD8aMtcIUsDho7Kc/x+BGEcIyEcIk2UjhKzSEsN5gP/3tCGER+EOEsAzW6lsRwghhd7wRYVS1m5XBIP21vtYHY8ZaYQpYHDT2059jcKMIYZkIYZJspPAVGkJYb7Cf/naEsAj8IUJYBmv1rQhhhLA73ogwqtrNymCQ/lpf64MxY60wBSwOGvvpzzG4UYSwTIQwSTZS+AoNISycpzXYQMMfsCdG4y9qIBsQhi9rMIw/tqdf4iDNBzXYi/9Q82MN+HPN/9U8o8GoXtB8S4PV+KYGN/qeZqI6bTCMn2qgmn+qQe13NLgvjkL9Ew2GgeljRujq6xrw/7f3frG2neV97hJKqyo6atqqiirUngtKqqoXVXUujtpUqrbatDr9F7VSm5CEEDdQIIaQhJDmfwjYxhjHOI4xxDHGdpDjWgQhC6FzekMufHy2LIQQQgghiBAHWT6WZSHLylUv1gEv9vT7Pu8cvzXHnstzee/1/PQIzTm+b3zj+74xN+N99kYDSB12EvmLzl0dTANCeGJ6G7Ab2Dr8ru7uoPMnO5/o9FmhVM2FLMr6B1tdy875XAAHQPGNWaEWnwZVQWeQPW3VNABWhN1AK8DGZrCTuNDJZDasap0Tq6DzqnMBpgGw7TgXrRnc0FV3H2CSs0MFF+rWOstTETkkfLD3HH/qUwH2vk6z9H+ZuHTcmLVBXXuLQqgQKoQKIetpzAq1+JTACjqDVUqQpwGwIuwGWgE2NoOdxIVOJrNhVeucWAWdV50LMA2Abce5aM1kT8t3H2CSs0NFIRR5BcMHe8+UwLVCeFzCtt2CE696nE3qlDZhp5Kl1qXjxqwN6tpbFEKFUCFUCFlPY1aoxacEVtAZrFKCPA2AFWE30AqwsRnsJC50MpkNq1rnxCrovOpcgGkAbDvORWsme1q++wCTnB0qCqHIKxg+2HumBK4SQijT1RnU1Z21S3Yceanb0nFj1gZ17S0KoUKoECqErKcxK9TiUwIr6AxWKUGeBsCKsBtoBdjYDHYSFzqZzIZVrXNiFXRedS7ANAC2HeeiNZM9Ld99gEnODhWFUOQVDB/sPVMC9xHCms0/zU1prAdLr5eOzM44WJs2x2dm6+as2lQP4vjWPpuDxuwY1LW3KIQKoUKoELKexqxQi08JrKAzWKUEeRoAK8JuoBVgYzPYSVzoZDIbVrXOiVXQedW5ANMA2Haci9ZM9rR89wEmOTtUFEKRVzB8sPdMCTwTIaziFD7jwzx+6ueTr5vPyNLI+Lo0+NLBzWdjdgxKVSgBSnPU0xAzBAqEzrdE88RrJ1H0P9BBLf6pDoJpoMqHTjzZwfst7+881sEkn+9g29EZsvGVDu4ClvBE5+EOLoQlYCh0vqPzhc6n4rajFff3Gx0IMFqxz7d28Kt7qgMDfLTzzQ6CH2Fe/guduzo9KFX/9E8bvXIln/hEA+di5Fnoh6I/t4JVBohzs5lgCQDLxxsssVc4F51XzQrAPfJu4EJTXcJQaMVQU/IrDz7YwAJXySSuuwrsBhYIcMtWnYvOcetmeSoih4SPxZ4pgauE8OiKIEGToEzVpurxrQeXOp96fCY0He0w4Pyw9asxp0YhrKBwVwgrCqFCuECuxfNQkA10xhKAQliZEqgQbohbN8tTETkkfCz2TAlcK4Q11aAQdKjBwaXOpx6fmU0vTejFbA6iz/yAvNTbmB2iEFZQuCuEFYVQIVwg1+J5KMgGOmMJQCGsTAlUCDfErZvlqYgcEj4We6YEnpUQ9pbvZetxHFwa5NTjM7nnqQPOD8ZcXRTCCgp3hbCiECqEC+RaPA8F2UBnLAEohJUpgQrhhrh1szwVkUPCx2LPlMBVQhhUqjZtPT4/zONLn08+bP1aE3qGweeF6sF63JgdoxBWULgrhBWFUCFcINfieSjIBjpjCUAhrEwJVAg3xK2b5amIHBI+FnumBK4SwqMrsgRl2uX40pGtTTi4+Ty/1symOtqmdXNw07Q5Xj/PDsbsGAgS3kKJehr5XOemDlpRT9/SgQN8sQNBgpmgrAef7EAn0BmBiZ0IyQZU+TCTL3VggB/v3NvBdaFtn+lgZJz7XHzN5gMdSA7u/pc72FhcCHf/zzt3dDBnBLcM14VbovOnO/jVPdNBKy6Enwq2Dj/RJzvf7vQLoXJdVfWiYkbxjSo/t+K6WRgeeKDx4IONj32sgXMxcr5unjM6A3QGmDNaz/C6Wcywk+j80Y82puZVsO2rLgTy5mC96Dw3JGwO9vnh/mNA532I05jlqYgcEj72jTEHj0JYQSAqCqFCuEEhVAgXQOfsWtnTFMKzIk5jlqcickj42DfGHDwKYQWBqCiECuEGhVAhXACds2tlT1MIz4o4jVmeisgh4WPfGHPwKIQVBKKiECqEGxRChXABdM6ulT1NITwr4jRmeSoih4SPfWPMwaMQVhCIikKoEG5QCBXCBdA5u1b2NIXwrIjTmOWpiBwSPvaNMQcPCujnOvBDmMldHRTQECRUzFAgTANmggs93oER3d55ogMzQZWPJUAnHonvqISZ4FwoATwc+XwHLo2dfLbzfAed7+tcjsB5IKIIbihu2W0drAi5pYNbhhsKYNpf7Hyrg3yj83QHy8cCn+vc1MHvuc8518T5tZN4VSY6g1klh4o5g0lmTUVrfvknOufdADh3dqjgunka8/QKOuOGYuvQuupCmCQ2ByNn5j2twA/zEnIrePDBFfaYL4QfMDpjY/EnpTPLUxE5JHwaG2MOnscUQoVwAYWwguVjgc8phC+R5UohDN4yB69gktgcjJyZ97SiEIrIAeHT2Bhz8DymECqECyiEFSwfC3xOIXyJLFcKYfCWOXgFk8TmYOTMvKcVhVBEDgifxsaYg+cxhVAhXEAhrGD5WOBzCuFLZLlSCIO3zMErmCQ2ByNn5j2tKIQickD4NDbGHDyPKYQK4QIKYQXLxwKfUwhfIsuVQhi8ZQ5ewSSxORg5M+9pRSEUkQPCp7Ex5uC5p4O69uEO6ule1/JdkSig4ZZf6jzVQS3+eCcr0Oc6CMQMDoBzb+nc2UHQGYE/wBAwDbTCiJ7pwOI+3UFnbB1G/rMO7hEmiduNOWMn0Rmtv9XBrGDa+DFArdGKFd3Ryev9fAf7/GQnL+GRTu+M8hRF/yc+0fjTP21ArjAUSuQpgYH770/cd1/j3nsbaMXbL/HmzD/6o8aHP9y4557GRz7S+NCHGnffnbjrrsattzZuv73xe7/XQOvv/37jgx9s4EKYBlaE9f7hHzbQivXiQpjzBz7QwBKw/DPsfNttDXQGd9zRwBLyXdiHft1ZnorIIWHF1PP1GPY2xlxVFMIKzr1FIVQIFcItKIQK4VJnhVBEVsKKqYcK2MPeMcfHxzy0W676RGOulSiEFZx7i0KoECqEW1AIFcKlzgqhiKyEFVMPFbCHvWOu2uuu+kRjrpUohBWce4tCqBAqhFtQCBXCpc4KoYishBVTDxWwh72Xc1wSDtZWdECTMddTFMIKzr1FIVQIFcItKIQK4VJnhVBEVsKKqYcK2MPeMVtlb+vnpQ/GXK95tJPrWsgGSuQnOt/soNqGEmSe7jzV+XIHhvDF+J7JW+OrUHEugll9Yw3YWGgbOsM9cF0Ene/r4ELYybnzAZwLsEDkiQikDi6NJeBC+Jmh9YUOWnGhRzpzByq3dPAjxKw6sCkoAeQKNgXXeuCBRm6dmlfBhXDuFMgKRBR8vL8r8sH+2sk8DewG5ApiBtmAEkBywM03N973vgY6oxVGtMpqsAScixWBVZ0BpjHNrZKXf8stDbS+//2NbI+YFRaIczO4br/QLE9F5JCwRuihAvawd8wUwq1fwwdjrtc8qhAqhFeYOx/AuQALRJ6IKIQK4cI0FMLAqs4A05gSWMnLVwhFZCWsEXqogD3sHTMNEEFT/br5bMx1mUcVQoXwCnPnAzgXYIHIExGFUCFcmIZCGFjVGWAaUwIrefkKoYishDVCDxWwh71j4HVLmrc5Pj8Yc73mUYVQIbzC3PkAzgVYIPJERCFUCBemoRAGVnUGmMaUwEpevkIoIithjdBDBexh75HwD31L/wwYPhhzveZRhVAhvMLc+QDOBVgg8kREIVQIF6ahEAZWdQaYxpTASl6+QigiK2GN0EMF7GHvESjflEAcrK2br+hjzPUXCAPK3KwT6IwC+s8iyP0djPy1DoaCP2Aa+UKf6OBVmU938qxQ6OfOcI8TP9mAFT3UQedHO1g+btl98XZjCU918Abad3YwVN66b3SQJzvQNqwIINhJrAjrRecnOvhtYCjc35s6uFAfeRbcoSZGK6pedEYrJAclMlrf+97Gb/xG43d+p/G7v9u46aYGlGCVIeQVAQgD5OrOOxvojAvBl/Ba0VU2BX1CZ0wDYIF5r/JvA2BWuN24oe9+d+O3f7uBzvnc3/qtxuwfzn3Pexq5dc0kZ3kqIoeEj25jzMGTDQGtKL7RGSoyJbCCKIQVrEghVAgXZANVPjqj9WaFUCG8gkJYmOWpiBwSPrqNMQdPNgS0ovhGZ6jIlMAKohBWsCKFUCFckA1U+eiM1psVQoXwCgphYZanInJI+Og2xhw82RDQiuIbnaEiUwIriEJYwYoUQoVwQTZQ5aMzWm9WCBXCKyiEhVmeisgh4aPbGHPwZENAK4pvdIaKTAmsIAphBStSCBXCBdlAlY/OaL1ZIVQIr6AQFmZ5KiKHhI9uY8zBg0IWoCZGWY+aGKU5lABD4UKotjEUymtMA8KQJ4nrPtzJ7oFXR2JWyK2d3IoLPdv5ZueFDtb7SAdD3dLBdTFUBpKDVmwsLpSviyVAntH5yc5fdC53cC7ylQ5GRrCTn+/c3Xmq09Ua5SlcC5U6ql60osqHmKEVb4PEULl11cgAQpiHAjd3a0UrRsZ1cS52Eq1QL7hWFjO0Yla4EJaPOWPbce6qzrhQ3it0xsj5Qlg+FBda/pGPNPCKXbxyFq+6/Xh/XS1eZvvww40/+ZPALE9F5JDwAWuMOXimBFaeUAgLCmFFIawohMsjA6hIHgrAPdCaJQfnKoRhr9AZI+cLYfkKoYicBh+wxpiDZ0pg5QmFsKAQVhTCikK4PDKAiuShANwDrVlycK5CGPYKnTFyvhCWrxCKyGnwAWuMOXimBFaeUAgLCmFFIawohMsjA6hIHgrAPdCaJQfnKoRhr9AZI+cLYfkKoYicBh+wxpiDZ0pg5QmFsKAQVhTCikK4PDKAiuShANwDrVlycK5CGPYKnTFyvhCWrxCKyGnwAWuMOXi+2IEvoZ6+s/NoBzXxlzvIRzqomCEbGBn2+HTnkQ5GhhJgKICXYT7TgT3i3Ic7WUXe3skXymD5GAqTxLnYdqRrDLf98Q7Wm2/oZzq40G2dFzrInR3cfejiJztPdPBHI28ORsa2Yxp3NEZ52njkkUZuBblERmuuttH60Y827r23cffdjbvuSsAQ8ALP3IqXf2Lk3JrfFAogOdAnkA0QrVAvAOPFbmCfYVO4R+Chhxq43flnNn+llWxi+Tf5x3/cQCvmjM5YwoMPNuCW/Rc7y1MROSR8ovZ8Noa9jTFXFYUwoBDWPKcQLm8ORsa2Yxp3KIQvkZUvt2bly60KoUKoEIq8MuATtYcK2MPexpirikIYUAhrnlMIlzcHI2PbMY07FMKXyMqXW7Py5VaFUCFUCEVeGfCJ2kMF7GFvY8xVRSEMKIQ1zymEy5uDkbHtmMYdCuFLZOXLrVn5cqtCqBAqhCKvDPhE7aEC9rB3zPHx8cl/nnzYfN583bGPMddfFMKAQljznEK4vDkYGduOadyhEL5EVr7cmpUvtyqECqFCKPLKgE/UHipgD3vHbHU/fJ59atPmuDHXWVD1Xu6gru2FLM+FbKCAfqiDc7/cQaUOb7m/g9zUebIDx3u4gyXAar7SgXt8ovOpDjzt2Q72CvuMu4DNgYpA6SHeuAtY0T0dbDuCSWKfEbygFXcBy8dQODfflBc6sFZ0xgLvinyrg+BXhznf1+nTuOeeRrYptH74w4377ktA6lBPg1zlo/hGlY9aHHX8qlaASeK6mNUqf8grergvH63Zl/77f088+mgjD4VpYM7YKxggfgz41UGPAV6jCvAe0T/4gwbeI/pHf9T42Mca+/wYsBubXToh3t9ZnorIIeETtYcK2MPeMTC6rYK3Sx9jrr9AzBTCSnaPOxVChfBKFMICCvdc5edWgEniupgVRsa56JxX9LBCuIxCKCL7wSdqDxWwh71jpt2d/ANgPa4QmosZiJlCWMnucadCqBBeiUJYQOGeq/zcCjBJXBezwsg4F53zih5WCJdRCEVkP/hE7aEC9rB3TLC7TZNCaC5mIGYKYSW7x50KoUJ4JQphAYV7rvJzK8AkcV3MCiPjXHTOK3pYIVxGIRSR/eATtYcK2MPeIzv+618QwqUmY66nQMwUwkp2jzsVQoXwShTCAgr3XOXnVoBJ4rqYFUbGueicV/SwQriMQigi+8Enag8VsIe9R7ZaXz1Sle/kSGn/3hH0Meb6y0c6KGTv7aBwh8WhJkYtfrnzeAeVOlpfH8Gc4TxPde7uPNqBTaEVwTTe3IHVfLyDVrgl9grKByGEHmMnb+lggdg6uFYGG/tMByvCdXEuWsFbO7gQOuMnir93wLk3dZBPdzAy8q0OjBeTfL6RHSADM0GJDAPEu0ChBDBPvNASfPCDjWytuG4G/oChPvShBpYAPc5DoTNEBfoEb8kqgpsCHuxWA23DbmCSeG8qXoV6S3/Z6bvf3cDbTfH+UjjeBz7QwEtWAaaRfxvQRdxQkO8Rtg4bC+LfDszyVEQOCZ+oxpiDRyGsoHBHK6IQVp5RCBVChVAhPOW3oRCKyIBPVGPMwaMQVlC4oxVRCCvPKIQKoUKoEJ7y21AIRWTAJ6ox5uBRCCso3NGKKISVZxRChVAhVAhP+W0ohCIy4BPVGHPwKIQVFO5oRRTCyjMKoUKoECqEp/w2FEIRGfCJaow5eCAqCKQO9TS85bbONzsokR/t5Gr7zzvo/FQHrZ/voDOMCOt9oIOgFediGi90nu3AW6Ca2Dos4dYO9goWlztjzpc76IwfA243FohWBJuDv6TAdZ/sYIHPdXB/MRR2Mk8Sd+GRDoILPdTpQ8Hx8NpJvJQS9vhwfPslWuEt99+fQPGN0hwm9od/2ICJoXN2PAB/ABAkvO4SZgLmuzQDGBkKBGBTuG6eJM7FyNBy7EZW63yPMrj7+S5gRXlz5lYHcKFsj1jv/KuHwixPReSQ8BFqjDl4FEKFcGljLyuEJbgLjyiECuF2FMJK3py51QGFUOQ6hY9QY8zBoxAqhEsbe1khLMFdeEQhVAi3oxBW8ubMrQ4ohCLXKXyEGmMOHoVQIVza2MsKYQnuwiMKoUK4HYWwkjdnbnVAIRS5TuEj1Bhz8CiECuHSxl5WCEtwFx5RCBXC7SiElbw5c6sDCqHIdQofocaYg+cLHdTEsCnk251Pdp7oIN/q3N3JrZgkvAWteEUnZAOd4Q8nprcBnaETkLrPdL7c+UQHVgNLx2483HmogwuBZzv3du7rYGOf72BzwGOdr3Qw8i0d5EVreonc+kgHGwtdvLWDVpgn/qTgQvjlPN7BW0b7dfEGS4C3I0L58mtFcW580SJbYY9wyzwUzkXrKomFLWeyLefWPOe8sZhGvu6cdgX+PztUcCHMGRsLHnwwvYQTP0L87QAMH56W31+KV6HedFMDrZDJqYgVmPaa1lmeisgh4YO958EY9j6LHB8f85Ax13sUwopCqBBuUAgVwt02FtPI153TriiECqHIxYMP9p7vmd9C2PssohCaCxiFsKIQKoQbFEKFcLeNxTTydee0KwqhQihy8eCDved75rcQ9j6LKITmAkYhrCiECuEGhVAh3G1jMY183TntikKoEIpcPPhg7/me+S2EvWNOTO/4xWyObIJuoUM9Xg8ac+1GIawohArhBoVQIdxtYzGNfN057YpCqBCKXDz4YO/5nvkthL1joHD1Kz5vPbj0+eSDMdd0vtT5sw7qaeSZTj4XBTRA8X1XB5OEmOVXR2KSCDpDcbEEXOiJDjo/3bm9g84Ac77c+UYHS8BQt3YwMpaAQCaxfAQ2dVvnjg5asUDcbtjUnZ2nO5/v3NLByNirRyJYPn6EGBn2iElebqx6KyOqbRTQ73tfA7V4LpEBzn3/+xuYxs03J9773gYmic5YEaaBzcl7lVeEJeSNxSSzxuBC8CW8wBMvd4V5wvFgrVk1YYAYGY6Hd3Lu81pRvAoVnfEjxB2cv8NwB/PvGbPCNDqzPBWRQ8KCoocK2MPeMZC3pa/zQz5uzHUQFLLV6P5sVMwI7CKfOyvsypMKYQFzflEbFEKFUCGcEhj2Kq9oSmDYWExSIawohCKyHywoeqiAPewdMwUPQbfNh3zcmOsgKGSz1CGwi3zurLArTyqEBcz5RW1QCBVChXBKYNirvKIpgWFjMUmFsKIQish+sKDooQL2sHfMkuAhS+K3dNyY6yAoZLPUIbCLfO6ssCtPKoQFzPlFbVAIFUKFcEpg2Ku8oimBYWMxSYWwohCKyH6woOihAvaw90iVtyl4W1vrh10+n3ww5poOCtkTl9uAihmBXeRzZ4VdeVIhLGDOL2qDQqgQKoRTAsNe5RVNCQwbi0kqhBWFUET2gwVFDxWwh71HtipfPbJJPZg71OP1oDHXbqATYLpKALKBIvikqt5wa2eOVvnFDi6EFzzi3Fyp39TBrJ7sYAn5Qqt2EiuC8r3Qwaye7mAocLmDST7Qua9za+fuDmaF3cAkMQ3oIjpnXt/BxmKBj0THw8h4M+pjnds72GdcCDe0/whRyE7PCaD4RuGeS/O77mrgXACNgT9ku8BLKT/0oUYu6+F4WD5a9wHXxazQGWaCWeFc7PPddzegXtgcgM64KXkoXDf/6rL/Y/nojJGxfEzy3nsbH/1oI7/MFsYLW0Zn+HD38FmeisghYWVqjDl4UDGDqS4B1MQor1Ei36oQFrAihXB3FEKF8CzAdRVChVBEDgUrU2PMwYOKGUx1CaAmRnmNEvlWhbCAFSmEu6MQKoRnAa6rECqEInIoWJkaYw4eVMxgqksANTHKa5TItyqEBaxIIdwdhVAhPAtwXYVQIRSRQ8HK1Bhz8KBiBlNdAqiJUV6jRL5VISxgRQrh7iiECuFZgOsqhAqhiBwKVqbGmIMHgvR4J1fqKHMhZqi2USLnAhoXylU+WhG0fqqDXO4gX+tg5Gc7aMVuoBXrBZCrRzvY9i92YLyPdDCr2ztohXrh7uOGInn5+BGiM7Ydu4FpILgQJvmRzkMRXPfJDuaMzi90+pxR1kPbYBe5UgfojDo+k4eCXWT3yPYIJYAwoPN99zVwIbgHfBivncR682tFwbvf3cBLR9EZO4nrYmOzmIF5xyt4myvOxXrBe96TQOdp18G0cRfw8863LLdmcG7/UzbLUxE5JHx0G2MOHoWw5rJCqBAugOs+qRAqhArhd5kSqBCKyBr46DbGHDwKYc1lhVAhXADXfVIhVAgVwu8yJVAhFJE18NFtjDl4FMKaywqhQrgArvukQqgQKoTfZUqgQigia+Cj2xhz8CiENZcVQoVwAVz3SYVQIVQIv8uUQIVQRNbAR7cx5uDJ1TZaUXyjzEW1jVr8+Q7q6c90MBSq7bs6CAQJgS891rm3gws90Xm2c7lzfwedH+3ATL7dweYgf9HBUM91sKKHO1Ag3IVPd+CWCKQdv5wnO1/uIPghfaWDkSH8aMVNyb+r5zu47tMd/E0KgvX2kVGqwmpQ16K8Rj0Nmcyv98R7RKFtUK/8+ke87zHz8fg2SLTiQvm1k2h9+OEGpoHWP/mTBGaFVgz1yCOJuSGVPDJace6DDzY+9rEEPBw/FfwI8VNBZ7RC6fGrQyumkX91/dWgbMWPAZsTd3KWpyJySPjMRI4j5kqOj7dvx9JxY2oUwopCqBBueF4hXCzNoV5TbAKQK4WwkkdGK879jgRWpgQqhAs7OctTETkkfGYixzzwUkLTlRz3sPkVHMz8JOxUstS6dNyYGoWwohAqhBueVwgXS3Oo1xSbAORKIazkkdGKc78jgZUpgQrhwk7O8lREDgmfmcjxlf8Em6YY6NC1aEc7znmp29JxY2oUwopCqBBueF4hXCzNoV5TbAKQK4WwkkdGK879jgRWpgQqhAs7OctTETkkfGYix1f+E2yaYoIQbv7ZbfYJB+vx2ad+qJ3nufUgjiOzdeuJ9SCOb+2zOWjM0VA+hVAhVAhPeF4hXCzNoV5TbAKQK4WwkkdGK879jgRWpgQqhAs7OctTETkkfGYix1f+E2yaYmA+m69VivD55EP9vFNEGQQAAEKvSURBVEvn+rX2wdetfdAfQdPS16UBlw5uPhtzxNqU/oAiGAU0ylzY4xc7GBky+aUOdAKgFn+m82cdtD7QwTS+2YGKYBoYGUv4RufzHXT+dAcLfLKDcyGEWCBWhFk90flEB8m7ASBId3de6MDTsEB0xoXu6aD10c63OsjlDu4CrPWJDq57VycGspENIYOqF2T1wvs84YdZGGCteFVmfn8pQGeMDPfAC1ohDLALLBDg3DwUmP0r8BaI2QMPNNCKu4D1AqgXXsGKncQdxP3FyJjkgy8K5wYYL35181dawbn4TeIXi53EnPG3IfgR4s2o731vZZanIrInj3/gT3aHj0Xk+Mp/gk1TzIn5bFKPl17NmurxrQeXOp96PBzc2uckoeloh4vOD1u/mgsehbCiECqEG3AXFEKFcIHZv6IQBhRCkeuUaX0BPhaR4yv/CTZNMVV78BmZTfXI5nP9uvY4DiLscSWzaeuJ6DaP46zNcWOOFMKOQqgQbsBdUAgVwgVm/4pCGFAIRa5TpvUF+FhEjq/8J9g0xUB7Nl930aGlzld9/NSDW5NHO/Wi84MxMwphRSFUCDfgLiiECuECs39FIQwohCLXKdP6AnwsIsc88FJC05UETapNW61pa2d8PvkQji811YP1+MwcrX7eOiA+z4P1uDFHCmFHIVQIN+AuKIQK4QKzf0UhDCiEItcp0/oCfCwix5HTMrUHggRNqse3Hlw6fvJ5c7D2OTkSzsVxZLbWszatm4Obps3x+nl2MOY7eVMHwesu4R7IbR0kv/wThTuCaaAWRz7ZyYFsIHlzkDzUnR0kXyh7GgK5Qn6sg+Rp5PsL/0ee6SD57sMtEZj2Z+IbWaFtyD0dJG/db3SQuLG//uuNd72r8fM/3/iFX0j84i82ZofK29/eeMc7GrguWn/plxq47jvf2UArzsXIeQn53DxnDIVWjIzOeYH7gJF/+Zcb+bqYM8APCSOjNXcGeQm4C6vATXnb2xqzfzgXdxCde+ssT0XkkPCxaIw5eGKpShNTCEPyUAphBcl3XyFcLGQJSvPZoaIQVjAyOucF7gNGhnrl62LOIDvelMDQGeQl4C6sAjdFIRS5GPCxaIw5eGKpShNTCEPyUAphBcl3XyFcLGQJSvPZoaIQVjAyOucF7gNGhnrl62LOIDvelMDQGeQl4C6sAjdFIRS5GPCxaIw5eGKpShNTCEPyUAphBcl3XyFcLGQJSvPZoaIQVjAyOucF7gNGhnrl62LOIDvelMDQGeQl4C6sAjdFIRS5GPCxaIw5eGKpShNTCEPyUAphBcl3XyFcLGQJSvPZoaIQVjAyOucF7gNGhnrl62LOIDvelMDQGeQl4C6sAjdFIRS5GPCxaIw5eL7RQXItfmMn56743sVscc92kFW+9OYOkofK52ZNzflWfPvlrR0ki8rHO893kJs6SL5Hb+0gX+hkP8zy/PbK3/t7R5WRPBTyhg6Cd5Ai2Ycf6/TEUpWtGZTmACPnAnqeXsn6lIeaHa4aTCOLyhSbCjpjqHxdtO6zsflC6IwL5esCLD9fF63YHHTGyLkVYIG4UAZDoRUj91nN8lREDgkfi8aYg0chrMlD5XMVQoVwA/KYQrg4jX3ANLIDTP3YXUXyddG6z8bmC6HzlMBwXYDl5+uiFZuDzhg5twIsEBfKYCi0YuQ+q1meisgh4WPRGHPwKIQ1eah8rkKoEG5AHlMIF6exD5hGdoCpH7urSL4uWvfZ2HwhdJ4SGK4LsPx8XbRic9AZI+dWgAXiQhkMhVaM3Gc1y1MROSR8LBpjDh6FsCYPlc9VCBXCDchjCuHiNPYB08gOMPVjdxXJ10XrPhubL4TOUwLDdQGWn6+LVmwOOmPk3AqwQFwog6HQipH7rGZ5KiKHhI9FY8zBoxDW5KHyuQqhQrgBeUwhXJzGPmAa2QGmfuyuIvm6aN1nY/OF0HlKYLguwPLzddGKzUFnjJxbARaIC2UwFFoxcp/VLE9F5JDwsWiMOe/k94h+s4N8rYOs8qWn4tsgs5hl53mkk/N0B8mamtd7Rycn70ZWkc93kE91cvJQ+aZkMbsr/mUBkrcu398sovFdoEwW4Ac6yKMNVMy5Jo517brWKQmVVXYBL8W5uTUPlc/FWyjx3tQbb2zkzhg571VeArZ9ak8FnUEeGWDOYJ/Oq9QrM6cdLjQnVsHmAHSOt2yWpyJySPiQ7Dk+Og6wtzHmLKIQ1iiENXmofFMUwhqFcHnkKYHh3Ox4CmFln874ESqEInKm8CHZE6wvNG1yfHx6nzPJwS5kzAGiENYohDV5qHxTFMIahXB55CmB4dzseAphZZ/O+BEqhCJypvAh2XNifVv/bVAhNOZlikJYoxDW5KHyTVEIaxTC5ZGnBIZzs+MphJV9OuNHqBCKyJnCh2TPWQnhcUn9WnvWbI6jqR5E00nmWZsjxlwrUQhrFMKaPFS+KQphjUK4PPKUwHBudjyFsLJPZ/wIFUIROVP4kOw5QyGcB+vnKm9rP5983XzGVzQZ88rPOzo5ucrPr6x8uLOqFXmhg9zbQbIhZLtAsoh+roM8EP0heynyyfgu0DzJLPzZxJCvdpCsuPm9qask9ssdJG/77R0Er2/N+UR6e20uZGelW0GZOw2qgpFXVeq5cJ8dApgzWjHJVa377CSYu1eBTOJCGcw57+Qq9cIScN28QKwoyzNao2txGiCfC3JnrAiTBL3zLE9F5JDwsdhzSCHcHNzn+NavxlxbUQhrFMIahbBGIbzaczFntGKSq1r32Ukwd6+iEFayp80dqORzQe6MFU0JrPTOszwVkUPCx2LPNSqEJ0dOguPGvPKjENYohDUKYY1CeLXnYs5oxSRXte6zk2DuXkUhrGRPmztQyeeC3BkrmhJY6Z1neSoih4SPxZ5rVwg3CU3GvDKjENYohDUKYY1CeLXnYs5oxSRXte6zk2DuXkUhrGRPmztQyeeC3BkrmhJY6Z1neSoih4SPxZ5gfaFpk63+tvXz8YtZ9fnkw6lf0WTMKz8KYY1CWKMQ1iiEV3su5oxWTHJV6z47CebuVRTCSva0uQOVfC7InbGiKYGV3nmWpyJySPhY7Jn/Noh/J8zZ6m9bP5/I3iabDmiqB0uXl/qEI8a8YpPL6/s7yD2dnMc6yKMd5C/iu09z0Y9kX8qGkCe5StvytmdNfUMHWaVtj3eQPI1s2t/u5Ly9gzwb3+aaJ5nfBYrkm5L/LOTWJ9IrZ1HIAhTBaEWljtZcfOPcXG2jFeQ5Tw04K6BPaMUSpkFVsnrlC+Xrgtm/ggvlaawiD5WXgBs6/aqS7XHVTwVzBnnOaJ0bUpjlqYgcEj4Wzymam7nI2acIVghrFMKabyuEJQrhy8Mqq5lGUVEIwxJwQ6cEKoQisgd8LJ5TFEJzkbNPEawQ1iiENd9WCEsUwpeHVVYzjaKiEIYl4IZOCVQIRWQP+Fg8pyiE5iJnnyJYIaxRCGu+rRCWKIQvD6usZhpFRSEMS8ANnRKoEIrIHvCxaIw5ePYpghXCGoWw5tsKYYlC+PKwymqmUVQUwrAE3NApgQqhiOwBH4vGmPPOTfHVoHfG14rmd1R+qZOTZeMjHSTbYyzNma90kPx20zyNVaLy6Q5yuYM8GiU27ySSdyO33hP/7iB7KXJ7fPln3o0/7yB5kshdHSTf/X4h1MSomFfV0/uU5rm8nuV4IMtGrtTRipHRikkCbE7e53l6IN+FucYw51Vbh9a585U57QpGhg8DXHeOFkYGmCQuhM6rRgZzQ5avO8tTETkkfEgaY847CmFNlhyFcPfWrkCMQrgsKtnicK5CWMHm5H2epwfyXZhrDHNetXVonTtfmdOuYOQpgRVcd44WRgaYJC6EzqtGBnNDlq87y1MROSR8SBpjzjsKYU2WHIVw99auQIxCuCwq2eJwrkJYwebkfZ6nB/JdmGsMc161dWidO1+Z065g5CmBFVx3jhZGBpgkLoTOq0YGc0OWrzvLUxE5JHxIGmPOOwphTZYchXD31q5AjEK4LCrZ4nCuQljB5uR9nqcH8l2YawxzXrV1aJ07X5nTrmDkKYEVXHeOFkYGmCQuhM6rRgZzQ5avO8tTETkkfEgaY847CmFNlhyFcPfWrkCMQrgsKtnicK5CWMHm5H2epwfyXZhrDHNetXVonTtfmdOuYOQpgRVcd44WRgaYJC6EzqtGBnNDlq87y1MROSR8SBpjzjurDCHX8d+O75n8cnw1aC76kawiWVM/10Fu6OTc10Hyxj4TX5WZXyuK3NhBnuog3+ogWYCR2zpIFrMvxb87WPXbyH+z8MUO8lAHeXrNS2XjX0PM+ruCQnYWvruTdQKtAENBgaYV7E6+UAZDrZrVHK2CWe2zVyBPY44WmIOHofLvatXIOBcj4y4A/K1E/kuKeXogbyzo653lqYgcEj4We970/V8PsPfe8f+N0Jij07wFUQhrFMIahbBGIVwmXyiDoVbNao5Wwaz22SuQpzFHC8zBw1D5d7VqZJyLkaeqVaYEKoQiFx4+FnuC9YWmTY572DyyS5/dg9HOdnBjXr5kb0EUwhqFsEYhrFEIl8kXymCoVbOao1Uwq332CuRpzNECc/AwVP5drRoZ52LkqWqVKYEKociFh4/FnhPr2/pvgzsKYfg6c2qHVTnb0Yw5WLK3IAphjUJYoxDWKITL5AtlMNSqWc3RKpjVPnsF8jTmaIE5eBgq/65WjYxzMfJUtcqUQIVQ5MLDx2LPyyeEm382xMHcoR7fenBzfOuR0H/TYR5fOmjMy5TsLYhCWKMQ1iiENQrhMvlCGQy1alZztApmtc9egTyNOVpgDh6Gyr+rVSPjXIw8Va0yJVAhFLnw8LHY8zIJYZUrfN56cOkzPux+/NTPJ1/xAZ+NOatkbXuug3yik/PmDvKpDpK1LRfuyGMd5M74GtWHO0geGckG+KYOcmsHyUKIZInNK4qSc/S1Tk6+g9ke84/wG52cj3eQm+ILePOF4l9/rCpkcxGcW+dolVVKAPKF0JqLfrQCvDcV3HhjA7KBVjCvVcESMDKmgXPzAtEKcF2Q9xmtuL9zjZW5t5U8yXxdtAIMhVmhFWBWec6dWZ6KyCHhY7FnfyGsqcdLry3qdWqHkKXOZ3XcmDOPQlijENbkFSmENflCCmEBVT7mPOWkMuWkohCGVoVwmVmeisgh4WOxZ38hXPqMoM/mQz6+SR9se+erPn7yuY5szNlGIaxRCGvyihTCmnwhhbCAKh9znnJSmXJSUQhDq0K4zCxPReSQ8LHYc4ZCWL8umdVSh6XjWw8udb7q46ceNGbPKIQ1CmFNXpFCWJMvpBAWUOVjzlNOKlNOKgphaFUIl5nlqYgcEj4We4L1haZNlhTr+MVsPT47hM/4sNQBX08dEF/rcfQx5kyiENYohDV5RQphTb6QQlhAlY85TzmpTDmpKIShVSFcZpanInJI+Fjsmf82iH8nzJn6BBOrPlZblzrU40sHN03oWU/ZNOHg5jO+zs7GvHx5voM820Eud5DsWkh2gNvjeyb3cUskW80N8R2k+dWgj3ZyvtBB8iTv6CB3dXLui/b4Yx0kb/sjnZxsy/mX85kOsuqmPB5fsZt3o9/QWRbvziyLQ4mcy+tRJa9gXroyp12BMORzcV204txVkwSrJgmgi1O3KvtMErNa9eLQOVolzyoPhXPnkiv53HwXzo5ZnorIIeFD0hhz3lEIa7Jr3aAQlmQFytuuEF4tqKdzeb2qFl/FvHRlTruC6jyfi+uiFeeumiRYNUmgEFbmkiv53HwXzo5ZnorIIeFD0hhz3lEIa7Jr3aAQlmQFytuuEF4tqKdzeb2qFl/FvHRlTruC6jyfi+uiFeeumiRYNUmgEFbmkiv53HwXzo5ZnorIIeFD0hhz3lEIa7Jr3aAQlmQFytuuEF4tqKdzeb2qFl/FvHRlTruC6jyfi+uiFeeumiRYNUmgEFbmkiv53HwXzo5ZnorIIeFD0hhz3lEIa7Jr3aAQlmQFytuuEF4tqKdzeb2qFl/FvHRlTruC6jyfi+uiFeeumiRYNUmgEFbmkiv53HwXzo5ZnorIIeFD0hhz3nmqk/MXHSTXxGcoKvl1l/lC2RB+tpOTReWBDrLPEpBPxLdu3t1B3t7JeSGC3BrfjJoXmH9m+MX+YgfJ+/zVDnJ/B8Ekv9lB+ptgUfVmUEBnVp2LznhJIyQHnUeF3UBneAumMU+voDP8YR+yp2XmZgb2WX4+F/v8y7/cwFDoDPJ1MTKYo4WRM/P0MNSq9fYVzfJURA4JH5LGmPMOyuucXKkrhDUKoUK4iUK4bDXz9Ao6Tze7ahTCSr7ulMDKHC2MnJmnh6FWrbevaJanInJI+JA0xpx3UF7n5EpdIaxRCBXCTRTCZauZp1fQebrZVaMQVvJ1pwRW5mhh5Mw8PQy1ar19RbM8FZFDwoekMea8g/I6J1fqCmGNQqgQbqIQLlvNPL2CztPNrhqFsJKvOyWwMkcLI2fm6WGoVevtK5rlqYgcEj4kjTHnHZTXOblSVwhrFEKFcBOFcNlq5ukVdJ5udtUohJV83SmBlTlaGDkzTw9DrVpvX9EsT0XkkPAhaYw57zzZQT7ZQW7qvLmDZPf4eAf5RgfBOznz2z7/PL6U8tsdpJf1DAzw3g5yWwd5uINkecbysy89H98xm19niruP4JeT5Tnvxhc7SHZLCGH+meVpPN1BPhffqtqXEEtVtmZQBK+SjTlaIBsROqN1ClUFYpaBtQJ0xqymyQSdwE0BeSex/DnPytyQsDl52zP5XLQCzGrVUFjCXGMlD4XWVXeht87yVEQOCR+SPX////r/Aux9HeX4+JiHjDlUnlQISxTCGoWwRiG8WiWYdX8FwpCZQlVBZ8xqSqBCuNQKMKtVQ2EJc42VPBRaV92F3jrLUxE5JHxI9kwJvAohPL6SeqS0f+9IDVpPsvX41oM1p3bYmlPPOrWDMVedJxXCEoWwRiGsUQivVglm3V+BMGSmUFXQGbOaEqgQLrUCzGrVUFjCXGMlD4XWVXeht87yVEQOCR+SPVMC1wphFafN52lTODI7nByc3bb2rDm1w9acetapHYy56jypEJYohDUKYY1CeLVKMOv+CoQhM4Wqgs6Y1ZRAhXCpFWBWq4bCEuYaK3kotK66C711lqcickj4kOyZErhKCJesaR6fple/bg7ObvXIydd6cB5ZOojjtWkenEeWDhpzFXlSISxRCGsUwhqF8GqVYNb9FQhDZgpVBZ0xqymBCuFSK8CsVg2FJcw1VvJQaF11F3rrLE9F5JDwIdkzJfB8hXDzn1u/Ln0++ZC/rj196fjWr8bk5BdpZhV5rINk17qnk3Uiv8Hy2Q7yifjWzU937o9vkrylgzzQQW7vIB/pZPXKKvJMB7k7vmX0nZ23dpB8fz/VQSDtCHbycge5s4PkX86jHeQznc+tcDzmhk4PVGSVEOYiGMX3KvfIoLwGeVazf2WuMZyLvZpeFxxvDh6Y8wys2qsMhpoCGcDdB/lCaJ2nB3Duqm3HuWjFUHnkNX+OZnkqIoeEj8WeKYEvnxDWoPUkJ8c3rVu/brJ0HFnqtnTWUn8ktxqDKIQVhVAh3EQhXAaF+yoHmP0rc43hXIUwMFUtaFue8zw9gHNXbTvORSuGyiOv+XM0y1MROSR8LPZMCXz5hHDr55oqY1PMTg7WoMMmu3SrX3fpf3JkdjNmlyiEFYVQIdxEIVwGhfsqB5j9K3ON4VyFMDBVLWhbnvM8PYBzV207zkUrhsojr/lzNMtTETkkfCz2TAk8gBDOrzhYjWt+QPLIS6df9fGtX43JUQgrCqFCuIlCuAwK91UOMPtX5hrDuQphYKpa0LY853l6AOeu2naci1YMlUde8+dolqcickj4WOyZErhKCI+6Gi3Z1DwyO5x68PjFbD2+OYiv9ZTw+eRDOI6vtZsxu0QhrCiECuEmCuEyKNxXOcDsX5lrDOcqhIGpakHb8pzn6QGcu2rbcS5aMVQeec2fo1meisgh4WOxZ0rgWiE8uiJIU5nq8dq66XPqERzEmDi49cjW45vW0H/HbsbskmwXEMLn41soV711E3l2jdR9I75lFHKFZOV7pIN8qZPXm205S042T7h0fo1qdp68k1lybu9An5Dc+ngHeTK++RZumd9te18HyW8oRfIfHCT+vFGe5jI3V8xoRZWPwh3+kJVg1azyUGgFGDmzSgjXGALXiyWgM5aAfX7b2xpoxblZ6lbdsnxuBiPn9eb7i50EeSgsIV8o/xjmpQuzPBWRQ8LHojHm4Ml1rUJYoxDW3K4QLv/BQeLPO6sIWlET51ZUzNkQcmm+alZ5KLQCjJzJDqAQhnMzGDmvN99f7CTIQ2EJ+UL5xzAvXZjlqYgcEj4WjTEHT65rFcIahbDmdoVw+Q8OEn/eWUXQipo4t6JizoaQS/NVs8pDoRVg5Ex2AIUwnJvByHm9+f5iJ0EeCkvIF8o/hnnpwixPReSQ8LFojDl4cl2rENYohDW3K4TLf3CQ+PPOKoJW1MS5FRVzNoRcmq+aVR4KrQAjZ7IDKITh3AxGzuvN9xc7CfJQWEK+UP4xzEsXZnkqIoeEj0VjzMGT61qFsEYhrLldIVz+g4PEn3dWEbSiJs6tqJizIeTSfNWs8lBoBRg5kx1AIQznZjByXm++v9hJkIfCEvKF8o9hXrowy1MROSR8LBpjDp63d5AsV3gpZQ5sCrmrg7Q6/lWvOqqMwKYgk8jX4vs882s2n+ggX+18s4Pkd70+1Gl505sap0k78vEOAvNEsuNlTUXglsjn4us9IYTPJvWiW+YF5luWhfCF+HbTPo1pIwGUyKiJM7kWX3UhSA5acx2PaeC66JzBuRgZhgDQOdtjbn3XuxronFvzbgBsLCwubzvIywe/8iuNVa0A1807ic4ZDIXWuZmFWZ6KyCHhQ9IYc/AohAqhQrh1gfmWKYQK4RWy8uXWvBsAG6sQhqHQOjezMMtTETkkfEgaYw4ehVAhVAi3LjDfMoVQIbxCVr7cmncDYGMVwjAUWudmFmZ5KiKHhA9JY8zBoxAqhArh1gXmW6YQKoRXyMqXW/NuAGysQhiGQuvczMIsT0XkkPAhaYw5eBRChVAh3LrAfMsUQoXwCln5cmveDYCNVQjDUGidm1mY5amIHBI+JI0xB89THSRXzI/FF2ki93Zy8itJH4nvAs1umSt1BFKH5BeWdjP5G0eNdenu8ZqjBt4j+lePGqeI2Vc6OfmVpPmH9Eyn51LnlPyPDpKncWsHySMj+Uf4nk7MKsmBeuWqF60Adfyv/moDpfmqaju3TjkJooJzsXy0YpJZRQCmAeP9uZ9rvPnNDfytzM/+bOO//JfEG9/YuOGGxk//dOINb2igFRfCrP7rf21gRW95SwOd3/rWxo03NtCKrcNQq6aBkTO4Lmy5399ZnorIIeFjsef4//l/A+xtjLmq5AJaIawgCmFN/iEphMuBikBy4C0KoUKoEO6CQihy7cDHYs+UQIXQmDNPLqAVwgqiENbkH5JCuByoCCQH3qIQKoQK4S4ohCLXDnws9kwJvDohPD4+xgdjzCa5gFYIK4hCWJN/SArhcqAikBx4i0KoECqEu6AQilw78LHYMyVwHyHUBo3ZmlxAK4QVRCGsyT8khXA5UBFIDrxFIVQIFcJdUAhFrh34WOyZErhWCI+3hZ2MMSVv7qzJD3aOfqSzKtEfmG/Gt0F+Lr6j8nJnVSvy5x3k7g7y7cY/OGrALV/G5G2/rZOTh8rvtn26gzzU4K8OyUqf7TFPIy8Q6XNG4B5gVrqh6kU9nTsDlPWYBjrnSWIaAA4AI8oag6HyEvASTswZhpCBiMIe0TnvJFpxLjpnMKs8MnYDYKj5S6vA0/L9za0ZmDaGwi8H5+bfZG+d5amIHBI+FnumBK4VwqP4vxedijj7GHPRohDu3ooohDV5KIWwZBb6lVmOV2BEsepl52xTmAY650liGgCFu0JYQeeMQqgQilwX8LHYMyXwDIUQHggzNObCRiHcvRVRCGvyUAphySz0K7Mcr8CIYtXLztmmMA10zpPENAAKd4Wwgs4ZhVAhFLku4GOxZ0rgKiHcaF4NOxljehTC3VsRhbAmD6UQlsxCvzLL8QqMKFa97JxtCtNA5zxJTAOgcFcIK+icUQgVQpHrAj4We6YErhLCk5xIoCpozI5RCHdvRRTCmjyUQlgyC/3KLMcrMKJY9bJztilMA53zJDENgMJdIaygc0YhVAhFrgv4WOyZErhWCDceqBAas5Q7O0ismC+tejnk4x3k5MWVG5DsWl/r5GR7/HwHyXbxZCdnH03Nu5FHRr7cQfJ6v9hB8k4ieevyhfKLUvPvCnmig+Sh8rbHfUapimoboESGL6EVcgV+5mca8yWWV01+++XrX9/I564CKwKzf2WfacxrVfDi0NnhqsE0Vu3zT/5k4qd+qjE7hM64Luacp/ETP9HAyBlcd3ao9OvO8lREDgkfi8aYg0chrMkakwUpWw2S/UEhrMkXUggVwitMZarM/pV9pjGvVVEIK3kaCqHIhYSPRWPMwaMQ1mSNyYKUrQbJ/qAQ1uQLKYQK4RWmMlVm/8o+05jXqiiElTwNhVDkQsLHojHm4FEIa7LGZEHKVoNkf1AIa/KFFEKF8ApTmSqzf2WfacxrVRTCSp6GQihyIeFj0Rhz8CiENVljsiBlq0GyPyiENflCCqFCeIWpTJXZv7LPNOa1KgphJU9DIRS5kPCxaIw57+Tyep/CPVfbSLbHPI1cmmebQp6Jb5J8roNElz7FLlYlD5XdMooKk29K/uVgkv+jg0Am8w3Nrc93kEc6CH4qX+ggWYDjX0PManV3Xve6xo/9WOPHf7yBzqjFUU8D1PEAzvPG/vpHaOp/HS+TrECA8R7R+cbLyhytksU7XwjnYmQsEMvH5sDi8j6jc97YuSG7LwGd0YrrojX/rQQ6o3X+PUUFI+dWjJxbO7M8FZFDwseiMea8k8v6bGIKYY1CWKMQKoRXgCGAVZ6WNQYohGEJ6IxWXBetWb3QGa1TAoPy5VaMnFs7szwVkUPCx6Ix5ryTy/psYgphjUJYoxAqhFeAIYBVnpY1BiiEYQnojFZcF61ZvdAZrVMCg/LlVoycWzuzPBWRQ8LHojHmvJPL+mxiCmGNQlijECqEV4AhgFWeljUGKIRhCeiMVlwXrVm90BmtUwKD8uVWjJxbO7M8FZFDwseiMea8k8v6bGIKYY1CWKMQKoRXgCGAVZ6WNQYohGEJ6IxWXBetWb3QGa1TAoPy5VaMnFs7szwVkUPCx6Ix5ryTS2Tk6Q7ypQ5yOYpKlhwkXygLQ6vUX/Wqo8oIZhWr/FNkMstVXhFEJatIXv4qS89D9VzKb6DNQ+1jcUi+C2/oIF+NL1nNfojEaeTCfVb2uxfumVxtozNqaLRCrjArzBlD5WnMV2tWcC6mkZeASWLb0RmzysAA83oxDbTiXJB/Kmg9w93AUDg3d86tefmYFW73jTc20Ar6ULM8FZFDwsdizzf/+/8dYG9jzFlkVbX9tEKoEG7PJYWwJk4j1/FoBajFUV5nUHzDatA51/GotjErzBlD5WlMCVQIN+SfClrPcDcwFM7NnXNrXj5mhdutEIpcs/Cx2DMl8GyF8LikHixdmNxqzHWQVdX20wqhQrg9lxTCmjiNXMejFaAWR3mdQfENq0HnXMej2sasMGcMlacxJVAh3JB/Kmg9w93AUDg3d86tefmYFW63QihyzcLHYs+UwKsTwo3FBfHb2seYC5hV1fbTCqFCuD2XFMKaOI1cx6MVoBZHeZ1B8Q2rQedcx6PaxqwwZwyVpzElUCHckH8qaD3D3cBQODd3zq15+ZgVbrdCKHLNwsdiz5TAfYRwyQBxcJPNkc3xzVcc3xzcNNXM46WvMa+4rKq2n1YIFcLtuaQQ1sRp5DoerQC1OMrrDIpvWA065zoe1TZmhTljqDyNKYEK4Yb8U0HrGe4GhsK5uXNuzcvHrHC7FUKRaxY+FnumBK4VwuJlL2XT1Pt+LzheTzn5uvtxfD75gM/GnHse6yBPNf63o8bRn3VyvhEd74vxDaVZn7JdILlzrvJz69c6OX1j//ejRvaHU9JH/uGjBpN349YOAi9F4sic1b0dJA51yo8wqzWyz88st8Yf/6riG6+dBPAlmAmYLwsN77cEeDcmXliKV6GiddUkp24FcO4UyMp8k2plLrkyR9udOVolLwGd8/LRCtfKvzo43hujtuXrohVLyAvEufiJ4neF1nlPK/26szwVkUPCx2LPlMC1Qng0/k2v5kTYqradHCxdFr/uedyYV04UwpqsfLlVIayJI3NWCuFyaV4L8TcqhBGciwuBKQmVueTKHG135miVvAR0zstHq0JY6ded5amIHBI+FnumBJ6tENYsdVv6uvb4yeeTlHZjzj8KYU1WvtyqENbEkTkrhXC5NK+F+BsVwgjOxYXAlITKXHJljrY7c7RKXgI65+WjVSGs9OvO8lREDgkfiz1TAlcJ4UbAatjpSjZN6LP0de3xUw8ac15RCGuy8uVWhbAmjsxZKYTLpXktxN+oEEZwLi4EpiRU5pIrc7TdmaNV8hLQOS8frQphpV93lqcickj4WOyZErhKCE9yYl/TwZbMbek4vobjS59PPuCzMecehbAmK19uVQhr4siclUK4XJrXQvyNCmEE5+JCYEpCZS65MkfbnTlaJS8BnfPy0aoQVvp1Z3kqIoeEj8WeKYFrhXCrj21yImxV2+rBzddNU/26dPzkc808vjlizCswWcyejq8VzYk1MXNLB8lD5SVkyUHe1DnD1ifWvN7zqw1qedbU7FrPdXr+184pxns5vjY25/ZOzv/oIPn+5t/VKnvM0h798FIHRfB0swoKaJTmAKV5rtTf2It+ME8PQwF0xnpjpU7mGiuwmrwbuXNe/lxjZU77qsmeBuB4aMWK8npXgeXn3zNu90/8RON1r2vgbxYARsY0cMuw3s4sT0XkkLRH5PUY9c9cc8k29bRCeEatCmGNQrhcQAMIwyhtG6iJs9XUEn8yTw9D5dJcIdwdhTCAkTEN3DKstzPLUxE5JO0Reb1kI4H+e6C5FpNt6mmF8IxaFcIahXC5gAYQhlHaNlATZ6upJf5knh6GyqW5Qrg7CmEAI2MauGVYb2eWpyJySNoj8jqK/+tQc+0m29TTCuEZtSqENQrhcgENIAyjtG2gJs5WU0v8yTw9DJVLc4VwdxTCAEbGNHDLsN7OLE9F5JC0R6Qx5hWQbFNPK4Rn1KoQ1iiEywU0gDCM0raBmjhbTS3xJ/P0MFQuzRXC3VEIAxgZ08Atw3o7szwVkUPSHpHGmFdAsl0gT0c/fDy+szGX9auS/XCPwv2UkZG8G5CN+zpRzE6ZJLKqM/JwB7nc+IdHDebExzYgL3SQvISPdHr+aueUaTzSQe7vIHlk5P/s9LzlLQ2U9WgFEAacO2v3yiiLE7naXsWqaWRtw2689a0NtGJz8shYL8C5UK88jRtvTLztbQl0/rmfa2Bj8w8pLyHPGdcFmPPP/3xj9q9gGgALxBJyK4bq153lqYgcEj4WjTHnHYWwJo+M5N1QCGsUwpK3RG9BK0DVi3NRIoNpXwEY0dS83Vk1DSwQrdiNbGLYnDzylMAKzoVs5GlMCaxMCVQIN2CBWEJuxVD9urM8FZFDwseiMea8oxDW5JGRvBsKYY1CWPKW6C1oBah6cS5KZDDtKwAjmpq3O6umgQWiFbuRTQybk0eeEljBuZCNPI0pgZUpgQrhBiwQS8itGKpfd5anInJI+Fg0xpx3FMKaPDKSd0MhrFEIS94SvQWtAFUvzkWJDKZ9BWBEU/N2Z9U0sEC0YjeyiWFz8shTAis4F7KRpzElsDIlUCHcgAViCbkVQ/XrzvJURA4JH4vGmPOOQliTR0bybiiENQphyVuit6AVoOrFuSiRwbSvAIxoat7urJoGFohW7EY2MWxOHnlKYAXnQjbyNKYEVqYEKoQbsEAsIbdiqH7dWZ6KyCHhY9EYc/Dc3VmVWJojlzo/2EEr8zsdZJW23R5faJk19dkOkjUGuamDPNRB4JbIqmnk5L8d+GoHeb6zT77S+OGjxtFTHeTpaOnIn3eQPhR+wEc3dpAu/K8+asyyOIAqP4MSGTUxvGXKSQWdAa4bi2/KRh4KoMpHa5bJvHxM8u1vb0w3C87zjnc00JrByLgLWeryerFXWD5GRufcusrEcG7+bYA8Z4CRQZ/kLE9F5JDwmdkz++9+rjFmxyiENQphjUJYoxAug+viQlhCrvLnKiqQDbQqhGG92CssHyOjc25VCEVkP/jM7Jn9dz/31Mz/1/h6ZPP/LD+7GXOdRSGsUQhrFMIahXAZXBcXwhJylT9XUYFsoFUhDOvFXmH5GBmdc6tCKCL7wWdmz+y/+7k1G6mD8m0+4wiaZk9jrqcohDUKYY1CWKMQLoPr4kJYQq7y5yoqkA20KoRhvdgrLB8jo3NuVQhFZD/4zOyZ/Xc/t+bE6E7VvCUhNOb6jkJYoxDWKIQ1CuEyuC4uhCXkKn+uogLZQKtCGNaLvcLyMTI651aFUET2g8/Mntl/93NP8r3/0WfPpqn3VQiNOT3ZAbKY9cIdNTGT6/h8oZz80lHkrg6SJ5ntImsM0rf9bxw1Tkn2w8cb33/UWHWhS1npL3eQvs+nXPeF+IbSh+OLUvMtW3VTnugg/Sf6D44aRzc0VpW5KK9RfKPaXjUyKmaoCEaep1fyddGKJcAu8htKsRu4EOaMznmv8m7kVjge3HJKYOUXfqGxyksxDZD3Km8OOgPsRt5JtGIotIK8BOwGrgv65swSU0QOSXt+jsz+u5+7yZLmTeurR4o/spsxFzkKYU2epEJYc1khVAi3tyqECuEGtIK8BIVQ5JqlPT9HZv/dz93k6oSwZum4MRcwCmFNnqRCWHNZIVQIt7cqhArhBrSCvASFUOSapT0/R2b/3c89iv970ZPW0nf7kZMsHTfmAkYhrMmTVAhrLiuECuH2VoVQIdyAVpCXoBCKXLO05+fI7L/7uZuc6NyUuumHm6/oPM815sJGIazJk1QIay4rhArh9laFUCHcgFaQl6AQilyztOfnyOy/+7knWXK8zcGapaZ63JjrPln5ei5lB3h9B8mGAI35yQ7ybHz5Z86a9Z6S13WQ/MbOrCLZLZFovJfyLcuSc/eaF9LGaZzyotT/0Nkneeue7CCrfqI5cah9yvpsU3jrJsiuhVaAaWT1QuGOzquIZT1bs05gZCw/byxaX//6xk/9VOMNb2jccEMDNwUXAuiModAZC8RerVLN/BNFK+4CLgQwFG4ZlpBvys/8TONd72rcdFPjllsqs8QUkUPCx6Ix5ryzRpAuZbtQCGsUwhqFsCRX2wBWk0vkKYEVhbCC5eeNRatCWFEIRWQlfCwaY847awTpUrYLhbBGIaxRCEtytQ1gNblEnhJYUQgrWH7eWLQqhBWFUERWwseiMea8s0aQLmW7UAhrFMIahbAkV9sAVpNL5CmBFYWwguXnjUWrQlhRCEVkJXwsGmPOO2sE6VK2C4WwRiGsUQhLcrUNYDW5RJ4SWFEIK1h+3li0KoQVhVBEVsLHojHm4Hln5dWvPqp84QuNo6NPNv7yUeO1ndz6v3Re1cHrLn+4k4M3Ov61zvd1kH/cwZxzcKG/3cmdc/5RByOjFcEbO7F8nHupg914TQdD/bUO7i9+DDgXQee/0snBT+W1HUwSF8Kc8UPCUPn+4vd8qYPl33ln4/d/v3H33Yl77knccUfjPe9p/OqvNn7lVxq//MuNX/qlxjvfmXjHOxo4N4M6HrP6jd9o/NZvNdD6a7/WwMgZXPe//bcGtg7X/e3fbrz73Y33v7+Be/QHf9D40IcaaL3rrhXgZ3bbbY0PfCDR9Yk/JAD1et/7GhgK00BncOutjZtvbmBj0RmT/M3frKA2ffjt76/c+qM3isjLSnuAGmPOIwphiUJYUQgVQoVQIVQIR/EqImdLe4AaY84jCmGJQlhRCBVChVAhVAhH8SoiZ0t7gBpjziMKYYlCWFEIFUKFUCFUCEfxKiJnS3uAGmPOIwphiUJYUQgVQoVQIVQIR/EqImdLe4AaY84hqFzB3+yg9dUdVMyoetF6qYORUbjzlZXPN1CaYyhcCLnUwbkAnSkq/c2Z+1gNlr/qXLg0JAc3BQs8+lajd8ZfFnCSHOr+Tt8cdM7w7aZ4I2v/S4qjt3bQuU+Dbwp9vPP6BmbV7y9qYAQSx99Glpzf/d0G6lrIBjpjqF4EnzIUgORgKFwodwbQNoDNgYnB4uCleKEl3mCJd58CdM5vv0Qr3pwJPcacId4wz9tvb+AvCwAsDq2QyfmXC5V772187GON++9vfPSjDZz7wAONBx9sPPRQ4+Mfb/zxHzdwoQ9/uAF5/uAHG9jJrpqzPBWRQ8KnZg/+jgawtzHmajLr74pCWEFnelqXDYVQIbwShTAxJVAhVAgVQpGLBJ+aPVMCz1wIj0vqwdKlHakftp5rzLWWWX9XFMIKOtPTumwohArhlSiEiSmBCqFCqBCKXCT41OyZEnh1Qjh1Ln+dgjebls415lrLrL8rCmEFnelpXTYUQoXwShTCxJRAhVAhVAhFLhJ8avZMCdxHCHdXuNk0PTD0Meaayqy/KwphBZ3paV02FEKF8EoUwsSUQIVQIVQIRS4SfGr2TAlcK4TH27Jp6n1fymyaZ4U+xlxT6WX9q17VoGsBiMprGxyq833f1zi61EF/BNe91Dn62QYECRqDoLWv6Oivdr6vg1ZwdF+Fy+/JrbwLRx9vYM5wj34uL4RzO+x8qfOP4qtQT+7jhjF44+j/aHzf2OrKD3dwIUzjNZ0+Zy4QQ+FXh5HzevG7QnptytcwAnTGqxQBimC8hjEPld/ZCDDUPufmoVa9GxNgqHmtCrb9ve9N3NxfdznXuPt6AUbOPwasF39LAWkHv/7rDXhptla8kRXgXAj/7/xOY+5tBXcQP+/f+70V9Je7zvJURA4JH4s9UwLXCuHRssLVr6e64mwKfYy5ptJLVVrcrHQrKJF7Wc+hOiy+L3XQH8F1L3UUwopCWHmNQrhsRDgXnefgFQy1z7l5KIUw/BiwXoUwoBCKvJLgY7FnSuDLJIQ4sktT6GPMNZVeqtLiZqVbQYncy3oO1WHxfamD/giue6mjEFYUwsprFMJlI8K56DwHr2Cofc7NQymE4ceA9SqEAYVQ5JUEH4s9UwJXCeF3/8lvpLaWvu3ILk2hjzHXVHqpSoublW4FJXIv6zlUh8X3pQ76I7jupY5CWFEIK69RCJeNCOei8xy8gqH2OTcPpRCGHwPWqxAGFEKRVxJ8LPZMCVwlhCc58bSttoaDVfagjtMDl8415lpLL1VpcbPSraBE7mU9h+qw+L7UQX8E173UUQgrCmHlNQrhshHhXHSeg1cw1D7n5qEUwvBjwHoVwoBCKPJKgo/FnimBa4Vwyd82OZG9qnzzeG3afF7qYMw1lxsbsXJlxYzyGkUwwOsuISo9jz/e4HUvdfqF2BnCAJ1AHf8POmh9baSf+z//Z4OBXfy9DiaJJby68Zf/coPLx7ZfSluHoQDWywth6wBe4ImtwyRzZ+xV3sn4e2Yrp9HzjzsQ/ksNbA53sm/70Z13NlC5osrPRfC0oN3JI6MWz+ShcF20YjcAXh3Zy3qCkXMrwBKwwKxtv/u7DbzNdUp+cLy5twFsLOQ5s88tw02Zm1nBdTEyVjR1Oqh13sm55MIsT0XkkPTHrTHmHHKjQqgQnjAlsGlMXy8vhK0D2fFoYrEz9irvZPw9s5XT6FEIdycPheuidUqgQrgj2NihPYl9bplCKCL70R+3xphzyI0KoUJ4wpTApjF9vbwQtg5kx6OJxc7Yq7yT8ffMVk6jRyHcnTwUrovWKYEK4Y5gY4f2JPa5ZQqhiOxHf9waY84hNyqECuEJUwKbxvT18kLYOpAdjyYWO2Ov8k7G3zNbOY0ehXB38lC4LlqnBCqEO4KNHdqT2OeWKYQish/9cWuMOYfcqBAqhCdMCWwa09fLC2HrQHY8mljsjL3KOxl/z2zlNHoUwt3JQ+G6aJ0SqBDuCDZ2aE9in1umEIrIfvTHrTHm8LnUYOXaK2a2QlQAqu3v67ymg/IandGKfH8HhoBpvLaDVlTqPVz+Hp3ZigWe7MmG7KV5c/5WB3sFBcK244bmVowcL/Sf/lMDK6Jqvoxpr349Onqqc6jMtylWUASjgAa5YsZrJ3MBDXKlfnM3IoyMznmS0Kd3vzuBV2XmV1ZCA6BAq4wIQ+WdxDR+8zcbv/qrjXe9q4E3duL1nlj+b/92AzuJzcFO4uWf73xn421va7zjHQ3M+e1vb7zhDY0f/dHGv//3jX/5LxP/7J81/sk/afzQDzX++l9v/JW/0uiZ5anIK4qvX+/BH0ljzMFzqUFR6b7E1imBFbgWdALOA6tB5+w8cA+FsEYhTFEIlzUGKIQKoUIock58R5mOj443zK85+517tIFtZxf8kTTGHDyXGhSV7ktsnRJYgWtBJ+A8sBp0zs4D91AIaxTCFIVwWWOAQqgQKoQi58TXh8WtlLp9zlUIjbkIudSgqHRfYuuUwApcCzoB54HVoHN2HriHQlijEKYohMsaAxRChVAhFDknvj4sbqXU7XOuQmjMRcilBkWl+xJbpwRW4FrQCTgPrAads/PAPRTCGoUwRSFc1higECqECqHIOfH1YXErpW6fcxVCY4wxZpfAlpm7O8ZcVWA1P/ADjR/8wcarX53423+78Xf+TuI1r2m89rUNdP67f7fx9/9+4h/+wwYc79Klxr/5N41/+28b/+E/NGCe//pfN/7Fv6iwODXmLPJZs3P433U905Ar7H1GOf6OL8ec2sEYY8wFi0JoDhCFUCE0106+6znl39foQCO5M1pXdc6tZ/j168df37DqK/+7rmdK4BkK4XFPPV56bcmpHYwxxlywKITmAFEIFUJz7WT6Uk7unE0MWdV6hl+D8uWv/O+6nimBVyeEG4UL4re1z9ac2sEYY8wFi0JoDhCFUCE0106mL+XkztnEkFWtZ/g1KF/+yv+u65kSuI8QLhkgvkIaN9l6sB43xhhzUaMQmgNEIVQIzbWT6Us5uXM2MWRV6xl+DcqXv/K/63qmBK4VQsjbSTZN6Dk/rPpszLWZV6VXZR4d/U5nn3yjg/x5Z1W+1Mm5oYPc2lmVxzs5t3WQvFd3dJB8LvK5zhnmq52cL3SQuLF/o8OsmkbOs51Vief+83/e+JEfafyrf9VAZ1TMvczlUP/u3zX+439svO51jZ/6qcbrX9/46Z9u4E2SN9zQwLloxbkY+T//5wZeUPvjP974iZ9o/NiPNXAu1ovOuC72ChfCUD/5kw20Yr3YHLT+zM8ksFf5HqE1zxl3P68onwswK7RikvP0Cq6bz40buymUjTHnEj4We6YErhXCo22mt/laU4/jw47Hjbk2oxC2KIRnlVUmphAqhFfAyAphAHuV7xFa85yzeq06F2BWaMUk5+kVXDefGzf2s/HfLvzqV7++3F/5WOyZEni2Qrj16/yw43Fjrs0ohC0K4VlllYkphArhFTCyQhjAXuV7hNY856xeq84FmBVaMcl5egXXzefGjc2lql/96teX+ysfiz1TAlcJ4Xf/4W+ktpa+W3zv1A5bvxpzrUUhbFEIzyqrTEwhVAivgJEVwgD2Kt8jtOY5Z/VadS7ArNCKSc7TK7huPjdubC5V/epXv77cX/lY7JkSuEoIT3IibFPblryuflj12ZhrMwphi0J4VlllYgqhQngFjKwQBrBX+R6hNc85q9eqcwFmhVZMcp5ewXXzuXFjc6nqV7/69eX+ysdiz5TAtUJYza23fM/lNqnHt/bZerAeN+Yi5IkOklXkhs7TnXd1vtb5yc5zHVhNd8u/edTg+x4xjac6mMZvdfp1eSHMCiP3oS4dNai4sBos4cQxNvxIB3P+tQ4mCTF7JoKRv9l5oYNJPt7BL6fDje278eqjxtE/73y7039I3HYsEDt5uXND5/MNjMwLvaOBQvZnf7aBQvbNb268/e2NX/u1xrvf3Xjf+xq33db4/d9vfOQjjT/6o8Yf/mHjQx9q3HVXAyOj8z33NO6+u5FbP/jBxB13NG6/PfH+9zdmh935vd9rYFbojNY772xg67D8D3+4gY3N+4zWP/iDBDpjYzFndMYkMQ38kPAzw7n4TWKSGGoNnzXGnGuOjDHXVBTCSr8uL4RZKYQVhVAhvEJWvtw6JbCiEIZ9RuuUwAsmhOHfLs7262e/WfCrX/36IkfGmGsqCmGlX5cXwqwUwopCqBBeIStfbp0SWFEIwz6jdUqgQvjyfA01sV/9emG/HhljrqkohJV+XV4Is1IIKwqhQniFrHy5dUpgRSEM+4zWKYEK4cvzNdTEfvXrhf16ZIy5pqIQVvp1eSHMSiGsKIQK4RWy8uXWKYEVhTDsM1qnBCqEL8/XUBP71a8X9uuRMeaccwmlKsrxJztv7cDTek3MOh6du4lxGt0u2PrOCCaZjQjrzcIAfcKKMA1s3S82OPKnOjc02Blzhlzle3Rjg/cIUoetgx5DnyCxz3fg8JArgAVCzHAHu//T8N/QwRJe33lTB9PotsybgruArUNr/22gPL333gaKYIDiO2sbQLW9ahronFsx1H33NTBntIKPfrSBVlwI7oHOuC7AUFgRyLNC60MPNR58sLHqulggPBz2mFshV2jFhfCrA1g+2GfrVt0jrAhq3VtfLE6NMeeWI2PMOedSlg1YTZYNhVAhVAhPwNahtf82UMiizJ0SWFEIK7iQQqgQ7i6Ey/924Ve/+vXl/npkjDnnXMqyAavJsqEQKoQK4QnYOrT23wYKWZS5UwIrCmEFF1IIFUKF0K9+vRa+HhljzjmXsmzAarJsKIQKoUJ4ArYOrf23gUIWZe6UwIpCWMGFFEKFUCH0q1+vha9HxphzzqUsG7CaLBsKoUKoEJ6ArUNr/22gkEWZOyWwohBWcCGFUCFUCP3q12vh65Ex5ryDehoF9CpDMMasT65r8QrHm29u/MZvNPDS0R/90cY//aeNH/qhxg/8QOMv/aWGMddvXixOrzIPGmNeDP9cnV3qq3on7G2MuaoohMacaxRCY8413xW75X+7yF+/Uwe/6fu/vmF+NeaChH+uzi7B+kLTJsc9Ww+epJ/3vW48dOUgT14YGSfO40t95kEcqV+N2T8KoTHnGoXQmHNNVr789cFhgAqhuZjhn6uzy4n1bf23wR2FcPevyNbWk4Nbm47G8c3XXY6Hz0unG3NWUQiNOdcohMaca7Ly5a8PDgNUCM3FDP9cnV3OUQiPRoetIldz1f1nBzTVDrOzMXtGITTmXKMQGnOuycqXvz44DFAhNBcz/HN1dlEIFUJjjDHGGGPMBc3+QlgzW3EEQYfNVwy7dPylM3tTPYgPm8ym+cEYY4wxxhhjrufsL4RbPy8dmdmqYUsn7tLnaNuYs/PWppPPs7MxxhhjjDHGXIc5QyE89evWBDGb2XH8OebsubVJITTGGGOMMcZcoATrC02bZEPb0ayOXwyO1K+bLHXb5fgun0++Ll3dGGOMMcYYY66rzH8bxL8T5kx3Cq61lOlgJ0dqNsdrt3pkdq6tm6/ocHIQX3HEGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxuyYzf9ccxP2MMYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjzCn57Dc/G2BvY4wxxhhjjDHXTYL1haZNtv5/zePgSfp538vW4zg4T996ZH6o2XpwcxxN88gmm/7GGGOMMcYYc83nxPq2/tvgjkK4+9eZaVlXfWTpQ83Wg0fjeP5qjDHGGGOMMddJXuFCuPk8D84jWz/UbD14tHz8JLnVGGOMMcYYY67VnLsQbv5zfp1N9fM8svVDzdaDR8vHT5JbjTHGGGOMMeZazf5CWDNbcQQ56bDphq+zaeng1g81Ww9ujqNpc3DThCPGGGOMMcYYcz1kfyHc+nnpCLLpUE1sfgjHTz7Ppq2X3npwZum6xhhjjDHGGHNd5QyF8NSvM9XfpsudHKxBh83n2VT7bLL14Ay67XiWMcYYY4wxxlxjCdYXmjbJ7nSqSm3tsCR14fhsyiMjc8Dw1RhjjDHGGGOuk8x/G8S/E+ZMWapHZiuytcPJwd2bvquDwwOXTke2NpUzvteEI8YYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDFma+r/JvMk7GGMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxphTchwxxhhjjDHGGHPdJlhfaNqE/2fzp/3fzZ/aIWTVhY52uNapHYwxxhhjjDHmes6JEm39t8FdbGmtU63tX4Nz9xnqJPuPYIwxxhhjjDHXcF4mITw5jn/N23ytR2a32hSO1K+bEXCwfkCHzdfNEWOMMcYYY4y5WNm4H9g05SzZFESratjm4MnX0FS/ziP1xKXP8yCObw4aY4wxxhhjzIXLiRIdDzZNOSeuVbM5jm75OL7i+OZgTT1eem0Z5NQOxhhjjDHGGHMRs3E/sGnKWXKqHR1s6evWYbcePBrH5yCndjDGGGOMMcaYi5iN+4FNU86SU+3oYPP0kyPz+NLBo3F8XuvUDsYYY4wxxhhzEROUKDRtsuRUOzrYPP34xeDgScLxOv681tJFlwY0xhhjjDHGmAuR48ipORGwms1xdNt8CN3CwaPl40d9GvUgPszjOMWYlyP/P8R0Q/eS90OAAAAAAElFTkSuQmCC3d:T4108,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLi50ZXh0YC5yc3JjQC5yZWxvYypWficqbn4xJXJTNCouc20qMn5EKjJ+RGkgQEJyKyNyPyNyXyNydSNyfSNyKyRyKyQ3IkNCNyJDO05AWyhOQFsoOEBbKCZyUzQpNEImZik7UEhvdTsmJnIhNCVyLTclcjc3JXI3NyVyNzclcnc4IGpvUSpBZEJTSkJ2NC4wLjMwMzE5I1N0cmluZ3MjR1VJRCNCbG9iSCdbJiAgKyYgPCRhJSRGLXwlYUFjdGlvbmAxMDxSZWFkPmJfXzA8UmVhZD5iX18yXzFJRW51bWVyYWJsZWAxQ2FsbFNpdGVgMUxpc3RgMU1pY3Jvc29mdC5XaW4zMnVzZXIzMlRvVUludDMyUmVhZEludDMyVG9JbnQzMlg1MDlDZXJ0aWZpY2F0ZTJUb1VJbnQ2NFRvSW50NjRUb1VJbnQxNlRvSW50MTZITUFDU0hBMjU2Z2V0X1VURjg8TW9kdWxlPkZYdFZlVVh1TkZjaEFBTnlGVklzZE9kZ2dIQVZQZ1VyU2tZdEtiV0FOS2FybFVLcnJEUmxNU3FmQVN5c3RlbVBhcmFtZXRlcnNJbmZvQVZLTVZ0YkJ6S0ZBQnBoYkJjVXZ6SkJCQm9iSVdQV0xlSUVCekhwdm5XemhLVmZLQnRuUGNGUFNkYVVTQnFKdHRocXlXdlRmRlFnQm5QTkxIV0ljRnVCSkpDbHZvY1ZHUURDVEJHd1dJa011S1pHQ2ZMWklFZUxBdnlHQ05nYlJGRkVYY0lDWFlmRFd5S1NEVURMQ2FKV1Nzcm1ObmFDUW5YSHRYdUVuTnV0Q01hcE5hbWVUb09JRGdldF9Gb3JtYXRJREJmVHJZamdxRUJaVFdETnFqa0xHYndSYkRiekJHZXdaWWpEYWJyZG1jb0VRcmpEb3NzTmt3bWhEbmRrRG1rbmdsbUxqS0l4VmpXb0Rkb3hQVUFhc3JLekFyRFhIZnRwelJEYnlMRXlxck1vbVJDT09FaWx1SkZoSEdqSk9TUEVyeGhiTnhXYlRFRnhBVVpmdHRiVUV6dUtaQXhrZlNCU2NFYW1DRm5aVmpwemNFQUV2UGd5S2VlcUlsRUh5a0JuSmF6Z0l1UXZFVWJyeHhtZWhLeHZFTVFtd3VrVXlKd0VDeFJRd0JOSEtGblJNTWRQTUp6SmtMdE1GaWNmdnNlZlpERk9tU0ZrZ1d3QUd3SnJQbWdVVkZhbHF6TkJwblhGWE1FcnJnV2t4Vlh3aFpGcW9zbkpjU29PbEZRalFHRnV2Y1lTQW1GdG1ndGlLTnpYTnl1b0Z1QnhsdnNjcWtOcUZsRXBLVUdMTUd5Sll2dEZaSEVnYkh5bEhyd0ZzRnRlTXptV0NweEZKTmZ0anRKZFpLR1RFeEVBTXJkY2tRQ2ZOR05ra1R4dWtRUUd0S2lXb2dpc1JXRndQVEdjWnVRV2pUQ2xYR0FHZHJWZ1ZRWHFtaEdpaHZ6c0RuT3Rsakd0WnN5V295V2ZxYkRBdUdiUHRqQlJVbmNIanp3R2ZialFVTXRIdW9JSmdNeEdwUFZSVGVLdFNVTGh5R1dOSnJ3SmZTdkdaeERPT0hEenBBdHROb0dtZUhVT0dZZVdoUnd2Z0hpeU5aekNTcnF0SHRjT1NuSXdEVENJdGN2Z2NRdkJjY0RJdHVlcWRQQXhFSWdldF9BU0NJSXhDUGZDVnZva0J5SklTQWFNVGF1ckNjSkVrS0lOZ2tXek9FdGpqVklDVVpHdUNYZlZ4WUl6UE9ZcFhqVmdiSXNFckVGeXRGZXlqSW1GZ2F2dXlrWGxJeHpTQmxGQ2FoQ0ppZmd3WFFNY1VJU25yQ0pabVZBZnRrWnp6ekJESldGZUFPU1NoYkdqWEdKVmJ2cnRMV2ZzWkdKQ2tVVEd5amFhS0paTU1jRm9UY0VEdEh1UUpWUWpFSUxmY29KU0p1UUtzZ1dKeUxoRmVtY2FKRmRmdlNxckJ4eGZFakpORlNzc0RzREVyQWxvcWpKa2ZBU2duakd0cWxKYVh4eUplUGZycnZkbUptSnJlcEFZa0ZqRVdWZFJtSm9KY09laGhIUU1pbkpqakhIR3FCb2Fmb0pic3FwT3VYQWNtQ3hubnNKYU5KR2NNTlhFS1h0SllwUWFWZWFIQ0REdkpXWWZwSGlvV05IS21YZ2FBaVhQenNUS2ZGdlBZZkJORE5VVkttU09mbk5oTnZ5V0tWQmlTS1VIR3pJbm1kWktib2x5YUp4SU9jSHpLRXRUWXd2Tk5QVkx6S0dKVldmQUlvUVNJTFpLbmhxaGdDTUxmZFBZb2RIVnhQYmd3UExTZ1NqUUlSSGJqTGZUWWlEWEJHVkdNbUxoRWdyZ3NWQ1ludHJMb1VadVdLRE5sQ3ZMTWRLeElkVUZUZ3pMWllqQmlyeWVIc0hETWJ1ZkRBZ0d2Sk11SlNjbFlhV2NlZlBNdGZOQnFtRWtxaVd4WE1DZ0tmRElTZW1NbFZORk9DSlFPQlBqb013S2xxT3ZZUHZVaURQaVdHTm5TSXpMWWdZaVFUbU9LTkN6d3ZuWWpmU1hoU05XdnpFQnFkcGtQU2VWbmROV05uRW5yc0pXaGxhU1lOdWFsd3h0S1JQd2tuSGlOQ1ZKQlJka3h3aU5iSW5jRkRTVnFuak5TVGt1Q0ZCWEV6d1ptTlhPUUx1Q0JmTUF6cE52Y1hnWnhGS1FGT09iVXNYT1BLSmVHT1N5c3RlbS5JT3JacFV1emtXdlpscFJPR1paY3JNZEdtd3lVSExtU09iUkdrdnhrY3BSZk1VT3llRHVhZGNRbnNBaE9UVm1USndpTnJjWHdxT2x3YkhkdlNOZXlPeU9HU2JpR0ZHUG13b1BsZ25la2tQUENXVVRsS3JmU1BXZlJDYUNOYld6dWlQUWpiUFl5ZEJxa1hsUGtOc1JxckpveWxQRG93T3NySVNkQ1dTVG9QWFRxQklSWERPdlB6SkFDdHdNcEFRUEtlbXRTUU5JYnJsRGJRTWFvU256aXlobVFuVlBzVWVtYU5UWlNScElDZHBtQXJoVXFWUlZKZHZ5Rlp2enJSVldIU3dnWGZ5TU11UldUZlVjRFVPRnlSUEZjc1FpSFB1anBIUHlSZ2VBd0VMaGZ4amhEU1VQdWxyUGF2VEF5aW1GU1VCdlRZcnFBbXR0V0hTTHlrVU1iQlplWnJKU091WkFqdHlMdGlNa2VTc05iRU9semhlaVNOWnNCd2RWVEJvU2NZZ25WbXVyVnNTUm9vVVZVaFNUVFpzU2NJVFJQQ2VWdW5GQlR4ZkRwVlRseEJnYUVYT1RxTEVFdHF1VlNOUVRTY2JYZ01iRnZiZ1NUbUlxR0VuY2NLUXF0VHhTVEVmS1RQZG5Ha0pZV1R3Wm1vZ1pCc1FqVEhXaG9rTE1abUNjYlVMVVNpaUVQblNrSVVhVUhZZ3FaQ3VRY2ZpVUhRTUxnRGdDTW1sVVJ3c01id2lua29VQ1pTY2hOeUdnclV5UlpXdEROS2d0d1VqSVZNRlFIa09FS2d5RlZ2VkhacGNLVVpHVlpua0RYb09uemJaUEhWZ2V0X0lWc2V0X0lWR2VuZXJhdGVJVldYakZBcGViYm1MVlRub0xJcXJ2eXFtak9WQWVsV1VUZXdyZW5QVkdDcVNvRmVORVJWR2ZrTlNLQ2phVFZ3bVhyTnFYV2NOS0JkVlZYWG9ITEV5Wm5kVlRZSUtqTmpQeFRFTlVtVlhybGVyUk1SdFlwVmZYa2pXQnZ3SHBkbVFHdFZ6clpqZG1CbXlWT2l4RFZaZmlJV1hUZmdlaVdUZEZ0VFdEbm1xb3ZPZ3JpcGtVV0lHeWF0cWVLWmRadFpXS21Kd1NuV1ViWm9QQmRXU0psS1NYQmRIVGhXVnZoYVFLc1liVW1CaVdyR2tRRmtzdFBpV1ROdFBPUVVkcUVIdXVXdlBOZlZOeWhMUEZnSUNYRVpqZ2dkSUlTWE1GWFVMTVJvdlpQb1NYd3NlR2dzV2d1VEVaWEdmSGlnQWRLTmNnWG9yTktqSW9hUnV0WEV2T1VHQnFGZkdZRVFqelViSk5YYkxSQUtZd1BuR0xDU0VnWlJUS1lzWk5GR1ZFTHB4QXZmTVlpeUlNeHd4U293WWdQWXhrRlFobExtS2pUVFluREJlS1BHVmxQZll4WWNXS2VPelNMd0lyWVNtenFsQkVHVmtDeVlvUUlkUVBwUmZlSFpzcmNkelFEUFpyTE12SVpxYk9TbmlmQ0RrRU9aVXVibXpNaHFjUnhPWk9JY2x4SXR0U1ZaZVhNZlpnZXNYd0tjWlhUV25iS2NZWmF2dGZaT1RpTVBnRXJvWnZhbHVlX19KdUF5QWxYekxWcUpDYW1tTEJuSXZBS29MSGFsQkVFUmlEdU5QV2FpYXpIYVRPblduYURJZkV5ZmVoQnBhVmZwb3ZudENjTWVWQkFiYkpTdGFQRmJPQWJKbUpIdEZSd3BCYmZRRHBFWnhkUGhoSEViVnNSZHFXU0dOVHNPYlFKbXdwbXNhb2V1elNhYm1zY29ybGliYVpFdXpWRGRiRkhvYmFJaFR3dkpqcUlmWlNyYmdhTmxvVlFBZ091c2JWRmdMUklSVXV4dWJwbUVRa2RUSnRQUFFTd2J2S1VhWXdEb3RSV1dKY25GQnFRbFpUZll6RGJjeElUdXJQa2ZGSnJiY3ZhbGVMWHR6QWlaaGNTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpY01pY3Jvc29mdC5WaXN1YWxCYXNpY3R1d1VDUkR2aE14a2NnZXRfU2VuZFN5bmNmZVVrQnhpWXdjR2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkR2V0UHJvY2Vzc0J5SWRQRG9JR1dxdWN0RVFkRW5kUmVhZEJlZ2luUmVhZFRocmVhZExvYWRTSEEyNTZNYW5hZ2VkZ2V0X0Nvbm5lY3RlZGdldF9Jc0Nvbm5lY3RlZHNldF9Jc0Nvbm5lY3RlZE1lbEhZZHpsaGRnZXRfR3VpZGFDd3poQ3RkeVdXdWlBamQ8U2VuZFN5bmM+a19fQmFja2luZ0ZpZWxkPElzQ29ubmVjdGVkPmtfX0JhY2tpbmdGaWVsZDxLZWVwQWxpdmU+a19fQmFja2luZ0ZpZWxkPEhlYWRlclNpemU+a19fQmFja2luZ0ZpZWxkPFBpbmc+a19fQmFja2luZ0ZpZWxkPEFjdGl2YXRlUG9uZz5rX19CYWNraW5nRmllbGQ8SW50ZXJ2YWw+a19fQmFja2luZ0ZpZWxkPEJ1ZmZlcj5rX19CYWNraW5nRmllbGQ8T2Zmc2V0PmtfX0JhY2tpbmdGaWVsZDxTc2xDbGllbnQ+a19fQmFja2luZ0ZpZWxkPFRjcENsaWVudD5rX19CYWNraW5nRmllbGRDWWR6dU5xVFNMY21kTlRIY2piTFFteW1kQXBwZW5kUmVnaXN0cnlWYWx1ZUtpbmRSb3VuZENvbXBhcmVNZXRob2RtZXRob2RIRURzWFRtc1ZBZUVyZHlJdE5sQWpPSm5TcmRDbGlwYm9hcmRoeEd6UUFCYk9xS2V5cXVqREN4VXpydVlYZVJlcGxhY2VJc051bGxPcldoaXRlU3BhY2VDcmVhdGVJbnN0YW5jZW5Db2Rlc2V0X01vZGVGaWxlTW9kZVBhZGRpbmdNb2RlRW50ZXJEZWJ1Z01vZGVDcnlwdG9TdHJlYW1Nb2RlQ29tcHJlc3Npb25Nb2RlQ2lwaGVyTW9kZVNlbGVjdE1vZGVEZWxldGVTdWJLZXlUcmVlZ2V0X01lc3NhZ2VFbmRJbnZva2VCZWdpbkludm9rZUdldEVudmlyb25tZW50VmFyaWFibGVJRW51bWVyYWJsZUlEaXNwb3NhYmxlVG9Eb3VibGVnZXRfSGFuZGxlUnVudGltZUZpZWxkSGFuZGxlR2V0TW9kdWxlSGFuZGxlUnVudGltZVR5cGVIYW5kbGVHZXRUeXBlRnJvbUhhbmRsZVdhaXRIYW5kbGVUb1NpbmdsZURvd25sb2FkRmlsZUlzSW5Sb2xlV2luZG93c0J1aWx0SW5Sb2xlZ2V0X01haW5XaW5kb3dUaXRsZWdldF9NYWluTW9kdWxlUHJvY2Vzc01vZHVsZXNldF9XaW5kb3dTdHlsZVByb2Nlc3NXaW5kb3dTdHlsZWdldF9OYW1lZ2V0X0ZpbGVOYW1lc2V0X0ZpbGVOYW1lR2V0VGVtcEZpbGVOYW1lR2V0RmlsZU5hbWVnZXRfTWFjaGluZU5hbWVnZXRfT1NGdWxsTmFtZWdldF9GdWxsTmFtZWdldF9Vc2VyTmFtZWdldF9Qcm9jZXNzTmFtZUNoZWNrSG9zdE5hbWVEYXRlVGltZVdyaXRlTGluZWdldF9OZXdMaW5lQ29tYmluZVVyaUhvc3ROYW1lVHlwZWdldF9WYWx1ZVR5cGVQcm90b2NvbFR5cGVHZXRUeXBlU29ja2V0VHlwZUZpbGVTaGFyZVN5c3RlbS5Db3JlTWV0aG9kQmFzZUNsb3NlRGlzcG9zZVBhcnNlU3RyUmV2ZXJzZVg1MDlDZXJ0aWZpY2F0ZUNyZWF0ZU11bHRpY2FzdERlbGVnYXRlR2V0S2V5Ym9hcmRTdGF0ZVNldFRocmVhZEV4ZWN1dGlvblN0YXRlU2V0QXBhcnRtZW50U3RhdGVHZXRLZXlTdGF0ZURlbGV0ZUNhbGxTaXRlV3JpdGVDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZURlYnVnZ2FibGVBdHRyaWJ1dGVDb21WaXNpYmxlQXR0cmlidXRlQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZUFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZUFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZUFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGVEZWZhdWx0TWVtYmVyQXR0cmlidXRlQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZUFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZUFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlQXNzZW1ibHlDb21wYW55QXR0cmlidXRlUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGVzZXRfVXNlU2hlbGxFeGVjdXRlUmVhZEJ5dGVXcml0ZUJ5dGVEZWxldGVWYWx1ZUdldFZhbHVlU2V0VmFsdWVnZXRfS2VlcEFsaXZlc2V0X0tlZXBBbGl2ZVJlbW92ZXNldF9CbG9ja1NpemVnZXRfVG90YWxTaXplZ2V0X0hlYWRlclNpemVzZXRfSGVhZGVyU2l6ZXNldF9TZW5kQnVmZmVyU2l6ZXNldF9SZWNlaXZlQnVmZmVyU2l6ZXNldF9LZXlTaXpla2J3UWhNaUFrSWZEV2VRbWRobXljb21LZlNpemVPZmRCT3Joam1ibFJmWXh2TVZhaUl5VmZ2dWlIcmllUHF4TGp0dmFmTE5pYlROV0xrVlVsZmh0WlN4c0RraW1mRlhHcnZlY1RvcGZwT1RHWEhrS3lmelR4YXRQR0JTeWZFZ1hwc1Vhak5uSVBzSUhnTENiS3Zjb0VLZ2dFdUVLc0ZKTFNrUWdDcnlwdG9Db25maWdNT3lVbkFmVnRtTk9qZ2dldF9QaW5nc2V0X1BpbmdTeXN0ZW0uVGhyZWFkaW5nc2V0X1BhZGRpbmdhZGRfU2Vzc2lvbkVuZGluZ1VURjhFbmNvZGluZ1N5c3RlbS5EcmF3aW5nLkltYWdpbmdTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nRnJvbUJhc2U2NFN0cmluZ1RvQmFzZTY0U3RyaW5nRG93bmxvYWRTdHJpbmdUb1N0cmluZ2dldF9Bc1N0cmluZ3NldF9Bc1N0cmluZ0dldFN0cmluZ1N1YnN0cmluZ1N5c3RlbS5EcmF3aW5nZ2V0X0FjdGl2YXRlUG9uZ3NldF9BY3RpdmF0ZVBvbmdzZXRfRXJyb3JEaWFsb2dKb1hmS0paQUZxUFZac2dpdU5YTHZad3ZFeGdMS3dRRllaVHN2RFlDaFZ2RGt5UExXYkF3Q2hKd2tFeGp0ZEdoc3hSc3RUcmZTWGJWaGF6VXhlTk9Cd2tWaGZDT3hNRmJaQ1ZTWFJHWmhaUE5vRllRaEl3aWh3TExpR2JIYk5GcGhWWFVxc2RuWHpwaENvbXB1dGVIYXNoVmVyaWZ5SGFzaEZsdXNoTWF0aGdldF9FeGVjdXRhYmxlUGF0aEdldFRlbXBQYXRoR2V0Rm9sZGVyUGF0aGdldF9MZW5ndGhFbmRzV2l0aEJnUG1YUGtudUl6bGh1aE9IdkNSdVhqdGd3aFNPd1Z4VGRQcVNhUG56aFJUd1pnckRvQmltSVJOb1VGYWJoRmlnT1NzRXlvUkFOaXJuVHJzZEd4Z1JpelJvRVVzVWtJT3dSa1dpQUhobWdzRHhNTmtpZUp4cmdPU3Z0a2lGWGFiVHhpR0pxaWxyREdrUWpNU3FpbG94dkVXekF3eGlLblNKQmpqZEZqdXNJbklBemJKaVZDSGpTSkpGbkdxRUFManRRdUpGWHJjSVZSak9KbnJUeXJBcE55VGp6QkhFZk5JU1htUGtqSVR3VUtRQ0t3dmptUGh2aGdXa1ZFa0xobldXZVhKTWFjRWtkQW51Y0NGRERHa2dSSEdvVVFXRnBoSWt2Rk9GZmJ5WE9rcGRpVmRtb1hha0FzeW5jQ2FsbGJhY2tSZW1vdGVDZXJ0aWZpY2F0ZVZhbGlkYXRpb25DYWxsYmFja1RpbWVyQ2FsbGJhY2tjYWxsYmFja1JlZ2lzdHJ5S2V5UGVybWlzc2lvbkNoZWNrRmx1c2hGaW5hbEJsb2NrSFlmZHlkbGhLSHZka2hVRWRxU0x5Y3RNa2t5U1hGa01xR0FBSkxQdHBrb1hpZlV5dXNCbGlPQW5sTG1NWURsendYemtUZFFGbGVxS09UZHJqWFBHbHppVGJOQkxMZFpGVW1LbGlYQnlzSkREUmpWbHR4Y2VzQUNCcFdsUnRsU2V0UHJvY2Vzc0lzQ3JpdGljYWxNYXJzaGFsTmV0d29ya0NyZWRlbnRpYWxTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsV2luZG93c1ByaW5jaXBhbGdldF9JbnRlcnZhbHNldF9JbnRlcnZhbFROaXZDa1l1UG15YmxwUWxYVHFmaGdXaWVsa2VybmVsMzIuZGxsdXNlcjMyLmRsbG50ZGxsLmRsbEtpbGxQb2xsUW1wUU5lbE54ZHRqZnJsek5HaXZnSlN1bGNwS2lKektvZHpsV3ZPdUNlVk9qemNFbVdOUUh4Q0lXYU5rSW1kZG1WQ0J4YlpBVG1CZm9KRFZCR0VXbVJyeFpLTktsU1FYbUZpbGVTdHJlYW1OZXR3b3JrU3RyZWFtU3NsU3RyZWFtQ3J5cHRvU3RyZWFtR1ppcFN0cmVhbU1lbW9yeVN0cmVhbWxQYXJhbXdQYXJhbWdldF9JdGVtZ2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW1TeW1tZXRyaWNBbGdvcml0aG1Bc3ltbWV0cmljQWxnb3JpdGhtSGFzaEFsZ29yaXRobWNOblRPT3FGWUZlUGltVHJpbVJhbmRvbWZXc3dic3RucW1JQ3J5cHRvVHJhbnNmb3JtRW51bU9YeGJSd21QakZZclpDbnBMYWdRZU9pU2xzR251YmhEdkNqSnN4TG5tZ1NadGNHQ0l6TW5jZ0JjelRWZXJEUm5CWnZJUHBrVVVLWW5Ub0Jvb2xlYW5UaW1lU3Bhbm9JWGdIamNIcWlLaW5NYWluWDUwOUNoYWluQXBwRG9tYWluZ2V0X0N1cnJlbnREb21haW5Kb2lubWZTQWpuaGVmQ3JsbkdldEZpbGVOYW1lV2l0aG91dEV4dGVuc2lvbmdldF9PU1ZlcnNpb25TeXN0ZW0uSU8uQ29tcHJlc3Npb25BcHBsaWNhdGlvblN5c3RlbS5TZWN1cml0eS5BdXRoZW50aWNhdGlvblN5c3RlbS5SZWZsZWN0aW9uWDUwOUNlcnRpZmljYXRlQ29sbGVjdGlvbk1hbmFnZW1lbnRPYmplY3RDb2xsZWN0aW9uc2V0X1Bvc2l0aW9uQ3J5cHRvZ3JhcGhpY0V4Y2VwdGlvbkFyZ3VtZW50TnVsbEV4Y2VwdGlvbkFyZ3VtZW50RXhjZXB0aW9uWGFHTXpYQ015SW9GZG5xcUtwUXJib0ltYWdlQ29kZWNJbmZvTWV0aG9kSW5mb0ZpbGVJbmZvRHJpdmVJbmZvRmlsZVN5c3RlbUluZm9NZW1iZXJJbmZvQ29tcHV0ZXJJbmZvQ1NoYXJwQXJndW1lbnRJbmZvUHJvY2Vzc1N0YXJ0SW5mb0dldExhc3RJbnB1dEluZm9QQUJLaWpxdGpvS1RrRXRJRGd1Z3BvTU1NcGJpTkNzcW9maW5GQkFrcEpOYnJvWmVyb2tsb2Fzb213VHF4SG9ZcEZWdG9STE1xWmJRSmdCY2F2b3BYaWR3SGhxcWRGdHpvTG1JcUZnemtCcHF5a2JtY1FNS0lwaWRyV01CbGh4bWR5bWdQcFVQS3R4VUtjVWJwU2xlZXBpaklFdFJjekRVQUNocFZLbWNobURqZmlwQ2NUeU5GWmx5TFRrcFB4T2dqZnZXUFVrcHFRQ3pwd0FFVk1vcE1pY3Jvc29mdC5DU2hhcnBYQVRLWml5QUF5UHFqdXhoWlVLaWlVdmpxU3lzdGVtLkxpbnFVUXlyZGRCaXlucVRiU0lPWVpSZkFoRVZQU3JxUEtaSlpEblBzcUVjTFhlalB2dnFzZFNqc1RwWVh3cXVTclFoTFB3WExhSFFCcnRGTVJIQnhtcWFFY0hySUZwV3p4d3BxZklyWk94a29SZkN2V3V0TnJibVpnT0ZObUZ0VmpyWHJZRVRDSERrclhBUUNacmN0ZHZPc1FEc0JhckNsZWFyQ2hhckludm9rZU1lbWJlck1ENUNyeXB0b1NlcnZpY2VQcm92aWRlclJTQUNyeXB0b1NlcnZpY2VQcm92aWRlckFlc0NyeXB0b1NlcnZpY2VQcm92aWRlclN0cmluZ0J1aWxkZXJTcGVjaWFsRm9sZGVyTWljcm9zb2Z0LkNTaGFycC5SdW50aW1lQmluZGVyQ2FsbFNpdGVCaW5kZXJnZXRfQnVmZmVyc2V0X0J1ZmZlcmdldF9Bc0ludGVnZXJzZXRfQXNJbnRlZ2VyTWFuYWdlbWVudE9iamVjdFNlYXJjaGVyU2Vzc2lvbkVuZGluZ0V2ZW50SGFuZGxlclRpbWVyVG9VcHBlckN1cnJlbnRVc2VyU3RyZWFtV3JpdGVyVGV4dFdyaXRlckVudGVyQml0Q29udmVydGVyVG9Mb3dlcklFbnVtZXJhdG9yTWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3JTeXN0ZW0uQ29sbGVjdGlvbnMuSUVudW1lcmFibGUuR2V0RW51bWVyYXRvckFjdGl2YXRvci5jdG9yLmNjdG9yTW9uaXRvckNyZWF0ZURlY3J5cHRvckNyZWF0ZUVuY3J5cHRvckludFB0ckpvcXliUHVyWUtWQ3NIZXFHTmNGaGpTRUVzZmpUbm51YnVwY0pzZnhoVEZuZVp2VUxMT3NaZERHTGFvblJzRm5Qd3plU3VXc1N5c3RlbS5EaWFnbm9zdGljc212aURVZ2lnb2NzRnJvbVNlY29uZHNHZXRNZXRob2RzTWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXNTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXNTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzRGVidWdnaW5nTW9kZXNHZXREaXJlY3Rvcmllc0V4cGFuZEVudmlyb25tZW50VmFyaWFibGVzR2V0VHlwZXNHZXRQcm9jZXNzZXNHZXRIb3N0QWRkcmVzc2VzU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5YNTA5Q2VydGlmaWNhdGVzUmZjMjg5OERlcml2ZUJ5dGVzUmVhZEFsbEJ5dGVzR2V0Qnl0ZXNCaW5kaW5nRmxhZ3NDU2hhcnBBcmd1bWVudEluZm9GbGFnc0NTaGFycEJpbmRlckZsYWdzU3RyaW5nc1Nlc3Npb25FbmRpbmdFdmVudEFyZ3NJQ3JlZGVudGlhbHNzZXRfQ3JlZGVudGlhbHNFcXVhbHNTc2xQcm90b2NvbHNTeXN0ZW0uV2luZG93cy5Gb3Jtc0NvbnRhaW5zU3lzdGVtLkNvbGxlY3Rpb25zU3RyaW5nU3BsaXRPcHRpb25zZU9ERW1icXVLZk11cXNnZXRfQ2hhcnNHZXRJbWFnZURlY29kZXJzUnVudGltZUhlbHBlcnNTc2xQb2xpY3lFcnJvcnNGaWxlQWNjZXNzR2V0Q3VycmVudFByb2Nlc3NJUEFkZHJlc3NTeXN0ZW0uTmV0LlNvY2tldHNzZXRfQXJndW1lbnRzU3lzdGVtRXZlbnRzRXhpc3RzS2V5c3dRa1dhcXlIeURSdGNTalZxRnVYZFpUdGZPa0V4Tkxjb0F1VnRqbnpGcEpYU0traUhhdENvbmNhdEltYWdlRm9ybWF0Z2V0X0FzRmxvYXRzZXRfQXNGbG9hdE1hbmFnZW1lbnRCYXNlT2JqZWN0b2JqZWN0Q29sbGVjdENvbm5lY3RTeXN0ZW0uTmV0VGFyZ2V0U29ja2V0U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLlJlc2V0Z2V0X09mZnNldHNldF9PZmZzZXR6Q1pWVHlXU2RJYVV4ZXRvcF9FeHBsaWNpdFNwbGl0RXhpdG5ZZm1DdWdiUldObHRJQXN5bmNSZXN1bHRyZXN1bHRUb1VwcGVySW52YXJpYW50V2ViQ2xpZW50Z2V0X1NzbENsaWVudHNldF9Tc2xDbGllbnRnZXRfVGNwQ2xpZW50c2V0X1RjcENsaWVudEF1dGhlbnRpY2F0ZUFzQ2xpZW50U3lzdGVtLk1hbmFnZW1lbnRFbnZpcm9ubWVudFN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvci5nZXRfQ3VycmVudEdldEN1cnJlbnRDaGVja1JlbW90ZURlYnVnZ2VyUHJlc2VudGdldF9SZW1vdGVFbmRQb2ludGdldF9Db3VudGdldF9UaWNrQ291bnRnZXRfUHJvY2Vzc29yQ291bnRFRlhuU014S29Gb3RHZXRQYXRoUm9vdFBhcmFtZXRlcml6ZWRUaHJlYWRTdGFydENvbnZlcnRGYWlsRmFzdFRvTGlzdEdldEtleWJvYXJkTGF5b3V0U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLk1vdmVOZXh0U3lzdGVtLlRleHRSZWFkQWxsVGV4dEdldFRleHRTZXRUZXh0R2V0V2luZG93VGV4dHZaWUREcUFRa3h0Q3VGY2RTUG5lS3l0bWRGSG9SQXFzRnp0Y2R4R1NaS3hsWG5FdVBteElidFZ1Wk5JdWJFeG9QbEVyaFRLdVhRZERYSFlNZWxSVVJMdW5NTlpaWkhrQkRnTXVlYlpBeG9HZ09RdVVFeFFZVkhjUXVNUldBeU52Q3ZQdnVjWldaZE94REZldUdoRnZYWGNUdHhOVVF0YWlLdlZYQ2hkbndGZUpyV3ZUWm5Hc0J2cll2ak5ERURXSW96VGV2Z1NOUUt5d29CS1ZWcXZXYU9kVHF3Snd2Qk95SURIc0FseEZ6dlJneEZJWXB6b1B3TE9waHJ5dEhLaXdwYlpZYld3S2l3Y1NXUHpGUVFsd0dldEZvcmVncm91bmRXaW5kb3dzZXRfQ3JlYXRlTm9XaW5kb3dNSnlXYmpydElyeWp3d1RvVW5pY29kZUV4VW5ob29rV2luZG93c0hvb2tFeFNldFdpbmRvd3NIb29rRXhDYWxsTmV4dEhvb2tFeFNCZ2JVa2tublN4UWtXckhCekh5WGpjVHhhZENyWVBTa1V4S0h0b2xzaGtrWnhIVGFteG1ETmdheHdlYm9XYnpiZEVtcWN4VXh4bHJaVlFVRGNiRWV4TXV0ZXhJQU9BakFqdnpWdmh4ekdrWFJHQlVCblhueFdOSGdOVGRqeHFuU0N5bXVtZ1FHd2ViaHlHSXlPb2J2aXBxZ2RrTVJ5a1FiZ2lXanJDRXpYeUluaXRpYWxpemVBcnJheVRvQXJyYXlnZXRfQXNBcnJheWdldF9LZXlzZXRfS2V5Q3JlYXRlU3ViS2V5T3BlblN1YktleWdldF9QdWJsaWNLZXlNYXBWaXJ0dWFsS2V5UmVnaXN0cnlLZXlTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5SmZ0eWNOQ3ZwSGl5RlNCZEhtWUZreUFrUXhIdERQRWx5QXNzZW1ibHlBZGRyZXNzRmFtaWx5aldBTnp6a0h4TnB5ak9leU1sbUZpbnB5QmxvY2tDb3B5cGdFRmJiSG1xeWJIZVVkaHlHRVFyeVRvQmluYXJ5Z2V0X1N5c3RlbURpcmVjdG9yeVJlZ2lzdHJ5b3BfRXF1YWxpdHlvcF9JbmVxdWFsaXR5U3lzdGVtLk5ldC5TZWN1cml0eVdpbmRvd3NJZGVudGl0eUlzTnVsbE9yRW1wdHlTV0poRFlEUnl5cldYbnpSRmZXVERRelhQb3lxdXJIeFNhUXpoZlJVa0JhbGNPWUFLaVV6c3JhSllkWVRBYXp3ZktZTU5qWWxNWWd6R2JrZkJ2elNuZHJ1eldyYXBOb25FeGNlcHRpb25UaHJvd3MxLjAuMC4wLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjZGcmFtZXdvcmtEaXNwbGF5TmFtZS5ORVQgRnJhbWV3b3JrIDQuNkl0ZW1fQ29yRXhlTWFpbm1zY29yZWUuZGxsPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIFdpbmRvd3MgVmlzdGEgLS0+ICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSIvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz4gICAgICAgIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+ICAgICAgICBXaW5kb3dzIDEwIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz4gICAgPC9hcHBsaWNhdGlvbj4gIDwvY29tcGF0aWJpbGl0eT4gIDxhc212MzphcHBsaWNhdGlvbiAgeG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIiA+ICAgIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgICA8ZHBpQXdhcmU+dHJ1ZTwvZHBpQXdhcmU+ICAgIDwvYXNtdjM6d2luZG93c1NldHRpbmdzPiAgPC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5Pg==3e:T558,OTNmZytRWUlHeHJudm1nRzNEQ29mL3V2VDUvbGprdDJpdnRjSEcwenhwR2RoSnc1M0FWcUJYc0RNRWttZzhWK2s0dTdFS3h6a2pUVEprTElwQTV3MHZSRzVtU2lPS0RPZmxibGJkOFJudzN1aWVLdEwwOUhyTVVMM2dPTVYzSnBOZTNpVVd4VVBDNHFPeGZTcS81V3VwWmdpWXFQc3VkNUlzaUcrMGtUVG11K1hXSU5qSXliNHVzWEVORzlGaFcrRlRkQTY2V2pXbHk5TlJydzJMdWlRY3hodE1uRVNqK1FmNnlkazExYnhXMzZLeitQc1pxRnVDTTVjdGVmUTdQWXREVnEzSm42VlFkWGtHUFEyQ0FhWmdISGdudUt5cU5sUCsvV3p5RFpGN3NMRzNnRU1TZzhQMFVPRFJ0Y2N2cmI3VnoyYUZhd2dJSjJKNTJKaU1uOVQ0Qmp2aStOSlBPWjdPbWYzZGlUL0huSnR1YlU3dkFhcEFHeEJjSG1OY2RibFlHSjloWGREZFlBeVBhZTlWRHhSdHE3OHlCbWNSQXJvSDQzSTFPNXUwS1JaVDV5UDVZbFFiT1hMbUtkN1UrMVZ0TnpkZVJPNm1TcVp0OWVIS2gxbDVJd0pwdHF4N1BsaXJHVWhlNHN4TWE0Z2FPb2R4N1BlRHpzT0VUT1k3ditvTTQyU1dQU0dWdlJuM1lPTld4QldocW1mRU5wNWlTRFUzeVJGMTVaNkNQd0tvNElQYlYrRStsTHBLWXRiaXVyWVlkZmtpTjcra1lOdGxhTlNXcHZLNkJWRnhLaURxazZ1azlqOGRhaVpNZzBPQ3FZNzhOektFZlY3WTRjOHpRWVBmemNONy9tWnBRdk9XdVFVakR0ZURhVU5XcDVjWlpOMkxOcDV2YmNTRTRKYXlHR1BSUlRlREN6SlZtYlpYYlUxbEpKYmpUMWZ4LzhIOHJ6L2ZpNDlHNjhqRUpzN2NxV1NScmcycmpHL3RWTlU3NFZqOW9PTU9zQkhFcFNUYlhHMzlsYjJzL2tkS21iWUZmOUJIS0lpeE9XZ1Bvb1RrWGN0VytLQXkwaVYvUW5wM2d2cTdGelErNUZSWC85Y3RYNmJvNlBhNG5wdEJhTkF0MkZEU3NMT0JMSHAzNG1saUx3ZVZLVStXME5FajRDU2J4TGc2cXFZenF0MW51cHB3cjViVFJ0TjV3cW5KdkE0U3Q1SHg0QW5sejVwK2RXZWFXU294a3JhRktOU1g2K3FROUROSnFpbXUzdUdiL00yTnBKa0VKbm8yTEZHV2ZBclU4RWxWT1ZHUXhVYnhkR2RwOC9ObFBHQWxpRk5DUW0zK1F0eGNGRUFOZVBMSWVJeEpCUw==3f:Tc3c,OTNmZytRWUlHeHJudm1nRzNEQ29mL3V2VDUvbGprdDJpdnRjSEcwenhwR2RoSnc1M0FWcUJYc0RNRWttZzhWK2s0dTdFS3h6a2pUVEprTElwQTV3MHZSRzVtU2lPS0RPZmxibGJkOFJudzN1aWVLdEwwOUhyTVVMM2dPTVYzSnBOZTNpVVd4VVBDNHFPeGZTcS81V3VwWmdpWXFQc3VkNUlzaUcrMGtUVG11K1hXSU5qSXliNHVzWEVORzlGaFcrRlRkQTY2V2pXbHk5TlJydzJMdWlRY3hodE1uRVNqK1FmNnlkazExYnhXMzZLeitQc1pxRnVDTTVjdGVmUTdQWXREVnEzSm42VlFkWGtHUFEyQ0FhWmdISGdudUt5cU5sUCsvV3p5RFpGN3NMRzNnRU1TZzhQMFVPRFJ0Y2N2cmI3VnoyYUZhd2dJSjJKNTJKaU1uOVQ0Qmp2aStOSlBPWjdPbWYzZGlUL0huSnR1YlU3dkFhcEFHeEJjSG1OY2RibFlHSjloWGREZFlBeVBhZTlWRHhSdHE3OHlCbWNSQXJvSDQzSTFPNXUwS1JaVDV5UDVZbFFiT1hMbUtkN1UrMVZ0TnpkZVJPNm1TcVp0OWVIS2gxbDVJd0pwdHF4N1BsaXJHVWhlNHN4TWE0Z2FPb2R4N1BlRHpzT0VUT1k3ditvTTQyU1dQU0dWdlJuM1lPTld4QldocW1mRU5wNWlTRFUzeVJGMTVaNkNQd0tvNElQYlYrRStsTHBLWXRiaXVyWVlkZmtpTjcra1lOdGxhTlNXcHZLNkJWRnhLaURxazZ1azlqOGRhaVpNZzBPQ3FZNzhOektFZlY3WTRjOHpRWVBmemNONy9tWnBRdk9XdVFVakR0ZURhVU5XcDVjWlpOMkxOcDV2YmNTRTRKYXlHR1BSUlRlREN6SlZtYlpYYlUxbEpKYmpUMWZ4LzhIOHJ6L2ZpNDlHNjhqRUpzN2NxV1NScmcycmpHL3RWTlU3NFZqOW9PTU9zQkhFcFNUYlhHMzlsYjJzL2tkS21iWUZmOUJIS0lpeE9XZ1Bvb1RrWGN0VytLQXkwaVYvUW5wM2d2cTdGelErNUZSWC85Y3RYNmJvNlBhNG5wdEJhTkF0MkZEU3NMT0JMSHAzNG1saUx3ZVZLVStXME5FajRDU2J4TGc2cXFZenF0MW51cHB3cjViVFJ0TjV3cW5KdkE0U3Q1SHg0QW5sejVwK2RXZWFXU294a3JhRktOU1g2K3FROUROSnFpbXUzdUdiL00yTnBKa0VKbm8yTEZHV2ZBclU4RWxWT1ZHUXhVYnhkR2RwOC9ObFBHQWxpRk5DUW0zK1F0eGNGRUFOZVBMSWVJeEpCU0dLbkRiSm9xNnJ6S3pTOS9WNFRiWllYdTZHNVNhZ0ZUc2xMR1BrRXREdUJLSUN5MzRjdDFyS2V6NDZXK3VSVDY0UTF5UzRDQ3RRbk5DN0VYSDhZWnVMdGxidTBjRGlEbGRHSFRUL1NuYkttaXZLVE40ckh5Nk1nWTFVU3U4WmhrcWtwZkZPOFFrMW5WVG1aTnpKMGp2NkRoQklhaGNJWG10WDh2cTZ3T1FFZTJFQ3JZM29zQWdjT2lJYVpnTWNuZ0s4WUlKODlKMStQL2h2K3RYUUd4YWRiZVJIdGxvOFExcUp6dCs0cjlrVmdKN001VTEwcXJLdmlFeGpwWEtkc3VEZFFzQ2ZhcnVoU0ZVL0t3OTROZ2YyNFhqMlVoMEJWV1BFbVM0TFZrdmx4YU9ONmlMN2JrWENNMHJmTG1wbWpmaE00YUpleFB1ZmNicTYwR3FBYklJMWViL2RIUVRSV2tNd2FBS2NVQ0tLNGp3ZEExTGp0MlRScnFBeVAvQk8wWnM0TTNNUXBaSkZ6ZFA1WjZZOHU3WnVyTndobTRUTlZxVnBRK09XZTR5UkxkNXBCL3hJT1Y5dVV0M0ZEVkhaVjB6K2NuUURJbWp6S3FpRlI2OVQzc1hFeUx0QmUwek5GNmRQNVhaLzBMZDlhSlBweG9oeFNjS3hoU1hQMDZlTUpmWExzQmRmNGZWcnJocTJnanlSeElicTZxU0ZEbHR3VDlDZzk5b3V2ZmgwMEZMSUtVNy9ocmF2aTlBMzVxd2ZsV2EzMENKZXhyM25XcXN4YlZnbGxlMm9CZzQ3V2tQWTRNejhkWkN6YlEvTHA0TlpYZHE3SkJKOEZHNTdvS1RpSmpSQktkL2VCZTlYVEJsQ0FvQXF4ZzkyZVFCZ1V0SmZCMUJGRi8yc0oyb0VJVHRDeUY0bWRkMnc1UFJGUm5EV2g1Yy8yRjJlYkFNby9LeXpyVTZYNEhNRlJyY3diVXVDbFY3NS9tQnlzVFZXMW9saU0rY1ZnZUtQTWdObVJqeVluS1VlSzVZN29VZ3M1QURkV3hveWVVR2VIekdCYTJxWjFmOHZRTXR1eU4wZVNBMWIrL2pIdmVvK29vR0wvelVqVDhDOVBpVFRqUmpNaEwxeEN4eWVINHdzTnp1blg2d0tRbitjZDkyNHJoMENHS08xRngxMXdscGQ2ZWFCKzluM0NRaDFDWTdFMGtIVzQxR3NXWUZPNm8yeDNlSnpuekJSK0wxZTJhQzhwUkRtblRhbXl4SmQwVlJHMVdiVi8vOWROY21zZE1UMnVqWGg0VFQvM2VxYngzdnJnbG1EV2YzWTBtQVdUVnV3bEhGTzdrNTVhOXJINTVZYTBSL0hta1RXeWI2NExNUldJMVhQcGorYUVuUnI5VjJlYXNnQjRJaHhTZTRaVms3YmVYWW1oQjBqN0wyRWJiMG5KZGZuaFVPMXIxbG9aL0VXZDVQSkJUYlVVWDJBMFFTMHpacGZXaUZhOVMvQkRoWnArVi9OdkdINVJnVzVlSWpCRk9yV3JKVW8zSzZvdWk4emRSREJ6aXZwZFhXMXArS25qMHBxUU1GbnlqMXc2c2pIdUNZUHFGclhsR3BXNnFoZzNiQzlwQ3ZnV3JGbm5mOExPSGFaYXhRQjRZK0sxYVJkcVFrV0l3K0FJS2EzR1QySGlBWUpJNE5PY09Ta2piZ2ViazRUa1JNRFFGVE9iMEFtamFpRGZMNmpTRXdVZEdKTGoxdEZJaWxnNFRjdGg2VFZURDkwYz0=40:T504,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIFdpbmRvd3MgVmlzdGEgLS0+ICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSIvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz4gICAgICAgIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+ICAgICAgICBXaW5kb3dzIDEwIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz4gICAgPC9hcHBsaWNhdGlvbj4gIDwvY29tcGF0aWJpbGl0eT4gIDxhc212MzphcHBsaWNhdGlvbiAgeG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIiA+ICAgIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hl41:T520,ZENqeVBjSWgwcCtweTdTeHVvaUw1QzhpVDROK0RBRndYSVRtK2ZYem5vNVl4ME83clduRHJlZ2IzOHNSY1lFaFk5Yi9WWFVIU2xobERZTDBodTQ5TjV0R2NxNldoekNCcHZMdGticHlVYUNaVEZlNUYxeERpOHpoZEVhbk40NEZZVldiSTRNUHVZQVBUcWFnNjllM3o0SENnYzFCNlFZWmhCbUg3UXdidnVXclhrb2sxNFI5SzlEZzBoUzROWldXL1ZOWWdZK3c2bkErSkRkWEVNd0pBcUptNmZaNXE1cWkrY29lTy8rdUpNdkYzTG9kbWRrbTBURGMyV09JN0FsUk45bDBiUUtXSFh6aGNzTVdZLy8wZjk4S2cxOHhqd0MvNHFTeDA5UktHSDA5bVdoZG1rcXhPQUNtbzZRNnJhVjhiaFR4SFVmMmtLYnVhdmlnRFV5cVJ2dHNJaDhoUVFabUZjRjdPSVpUdFAvYnhSVE15UjZkUU0vTHpwbDduRDdqYXBhUkpIc2JlZGxJdlZFZXZhd2lyV0o3aHNPNXErNGpQMVAzSk9tRG5SUnpHL256d1FjWEFwV3JDQjhXbmtoU09lWGFISjdta3lLNUJVQUNVUkJPNXpzeUNrdFdhTnh1dVZWeVR4L1pTVTRYZWtEUURyWUtETDNvZjBkTmUreGtzcno2Qmx6cXFESzNYT1FIbGkxWWZwRWIybS8reW44S3doc0NQMHc4bVJFUEszN2pZc2huOXFHMDhIdGJSb2RUa3NiSXlnZ1pHWkpVOU1FVWhQN0VHNFdkc0NOVXhVbitENTJOTTlKVy9tbmRHbGh5ZzY0VE9IRVZVT08vRTZ3WDQ0Y0E0L2YxTk9XRy96QzNGeG5VeUJlVHA0VzBkVCtSeTNQQXpFWjlHTEhLWVB2ZWlpS05ueUUzaHlRNWFGc2orMENnS042Zk82czJKYysyZmJrUmZXRk5tTEF1eGJXdzl6SnVvNUhaVUZzRVZBT0N3emhyeDFDdWlsSmp1Um8xVWVFWnpxNUw5bzVjNFlqVFJMS254VXAvMmdqTmxqL0k5TzIvU09HUmZGamtRaWwyeis5b0ZINWJOQmVvRCtQWDFoS083cnJ4YzA2SExWa3NoQnpnR1RIcFQrSnE0N2cxUG9BL1RENnRNZm1UVEd0SStFV0VDbzZNT0RUcjA2aGpIdFFPUGNtRVMyWlFZei9iWi9HbUkwTDI5WnQvblE1MkNmYVNmNjlBZDdmZFpnMlhxMmt1Z3ZkOHRVNHAyM2JUSnV4QmM1TUFBZU0veHNGRjlLNkYxQT0942:T558,R0tuRGJKb3E2cnpLelM5L1Y0VGJaWVh1Nkc1U2FnRlRzbExHUGtFdER1QktJQ3kzNGN0MXJLZXo0NlcrdVJUNjRRMXlTNENDdFFuTkM3RVhIOFladUx0bGJ1MGNEaURsZEdIVFQvU25iS21pdktUTjRySHk2TWdZMVVTdThaaGtxa3BmRk84UWsxblZUbVpOekowanY2RGhCSWFoY0lYbXRYOHZxNndPUUVlMkVDclkzb3NBZ2NPaUlhWmdNY25nSzhZSUo4OUoxK1AvaHYrdFhRR3hhZGJlUkh0bG84UTFxSnp0KzRyOWtWZ0o3TTVVMTBxckt2aUV4anBYS2RzdURkUXNDZmFydWhTRlUvS3c5NE5nZjI0WGoyVWgwQlZXUEVtUzRMVmt2bHhhT042aUw3YmtYQ00wcmZMbXBtamZoTTRhSmV4UHVmY2JxNjBHcUFiSUkxZWIvZEhRVFJXa013YUFLY1VDS0s0andkQTFManQyVFJycUF5UC9CTzBaczRNM01RcFpKRnpkUDVaNlk4dTdadXJOd2htNFROVnFWcFErT1dlNHlSTGQ1cEIveElPVjl1VXQzRkRWSFpWMHorY25RREltanpLcWlGUjY5VDNzWEV5THRCZTB6TkY2ZFA1WFovMExkOWFKUHB4b2h4U2NLeGhTWFAwNmVNSmZYTHNCZGY0ZlZycmhxMmdqeVJ4SWJxNnFTRkRsdHdUOUNnOTlvdXZmaDAwRkxJS1U3L2hyYXZpOUEzNXF3ZmxXYTMwQ0pleHIzbldxc3hiVmdsbGUyb0JnNDdXa1BZNE16OGRaQ3piUS9McDROWlhkcTdKQko4Rkc1N29LVGlKalJCS2QvZUJlOVhUQmxDQW9BcXhnOTJlUUJnVXRKZkIxQkZGLzJzSjJvRUlUdEN5RjRtZGQydzVQUkZSbkRXaDVjLzJGMmViQU1vL0t5enJVNlg0SE1GUnJjd2JVdUNsVjc1L21CeXNUVlcxb2xpTStjVmdlS1BNZ05tUmp5WW5LVWVLNVk3b1VnczVBRGRXeG95ZVVHZUh6R0JhMnFaMWY4dlFNdHV5TjBlU0ExYisvakh2ZW8rb29HTC96VWpUOEM5UGlUVGpSak1oTDF4Q3h5ZUg0d3NOenVuWDZ3S1FuK2NkOTI0cmgwQ0dLTzFGeDExd2xwZDZlYUIrOW4zQ1FoMUNZN0Uwa0hXNDFHc1dZRk82bzJ4M2VKem56QlIrTDFlMmFDOHBSRG1uVGFteXhKZDBWUkcxV2JWLy85ZE5jbXNkTVQydWpYaDRUVC8zZXFieDN2cmdsbURXZjNZMG1BV1RWdXdsSEZPN2s1NWE5ckg1NVlhMFIvSG1rVFd5Yg==43:T504,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIFdpbmRvd3MgVmlzdGEgLS0+ICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSIvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz4gICAgICAgIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+ICAgICAgICBXaW5kb3dzIDEwIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz4gICAgPC9hcHBsaWNhdGlvbj4gIDwvY29tcGF0aWJpbGl0eT4gIDxhc212MzphcHBsaWNhdGlvbiAgeG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIiA+ICAgIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hl44:T4108,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLi50ZXh0YC5yc3JjQC5yZWxvYypWficqbn4xJXJTNCouc20qMn5EKjJ+RGkgQEJyKyNyPyNyXyNydSNyfSNyKyRyKyQ3IkNCNyJDO05AWyhOQFsoOEBbKCZyUzQpNEImZik7UEhvdTsmJnIhNCVyLTclcjc3JXI3NyVyNzclcnc4IGpvUSpBZEJTSkJ2NC4wLjMwMzE5I1N0cmluZ3MjR1VJRCNCbG9iSCdbJiAgKyYgPCRhJSRGLXwlYUFjdGlvbmAxMDxSZWFkPmJfXzA8UmVhZD5iX18yXzFJRW51bWVyYWJsZWAxQ2FsbFNpdGVgMUxpc3RgMU1pY3Jvc29mdC5XaW4zMnVzZXIzMlRvVUludDMyUmVhZEludDMyVG9JbnQzMlg1MDlDZXJ0aWZpY2F0ZTJUb1VJbnQ2NFRvSW50NjRUb1VJbnQxNlRvSW50MTZITUFDU0hBMjU2Z2V0X1VURjg8TW9kdWxlPkZYdFZlVVh1TkZjaEFBTnlGVklzZE9kZ2dIQVZQZ1VyU2tZdEtiV0FOS2FybFVLcnJEUmxNU3FmQVN5c3RlbVBhcmFtZXRlcnNJbmZvQVZLTVZ0YkJ6S0ZBQnBoYkJjVXZ6SkJCQm9iSVdQV0xlSUVCekhwdm5XemhLVmZLQnRuUGNGUFNkYVVTQnFKdHRocXlXdlRmRlFnQm5QTkxIV0ljRnVCSkpDbHZvY1ZHUURDVEJHd1dJa011S1pHQ2ZMWklFZUxBdnlHQ05nYlJGRkVYY0lDWFlmRFd5S1NEVURMQ2FKV1Nzcm1ObmFDUW5YSHRYdUVuTnV0Q01hcE5hbWVUb09JRGdldF9Gb3JtYXRJREJmVHJZamdxRUJaVFdETnFqa0xHYndSYkRiekJHZXdaWWpEYWJyZG1jb0VRcmpEb3NzTmt3bWhEbmRrRG1rbmdsbUxqS0l4VmpXb0Rkb3hQVUFhc3JLekFyRFhIZnRwelJEYnlMRXlxck1vbVJDT09FaWx1SkZoSEdqSk9TUEVyeGhiTnhXYlRFRnhBVVpmdHRiVUV6dUtaQXhrZlNCU2NFYW1DRm5aVmpwemNFQUV2UGd5S2VlcUlsRUh5a0JuSmF6Z0l1UXZFVWJyeHhtZWhLeHZFTVFtd3VrVXlKd0VDeFJRd0JOSEtGblJNTWRQTUp6SmtMdE1GaWNmdnNlZlpERk9tU0ZrZ1d3QUd3SnJQbWdVVkZhbHF6TkJwblhGWE1FcnJnV2t4Vlh3aFpGcW9zbkpjU29PbEZRalFHRnV2Y1lTQW1GdG1ndGlLTnpYTnl1b0Z1QnhsdnNjcWtOcUZsRXBLVUdMTUd5Sll2dEZaSEVnYkh5bEhyd0ZzRnRlTXptV0NweEZKTmZ0anRKZFpLR1RFeEVBTXJkY2tRQ2ZOR05ra1R4dWtRUUd0S2lXb2dpc1JXRndQVEdjWnVRV2pUQ2xYR0FHZHJWZ1ZRWHFtaEdpaHZ6c0RuT3Rsakd0WnN5V295V2ZxYkRBdUdiUHRqQlJVbmNIanp3R2ZialFVTXRIdW9JSmdNeEdwUFZSVGVLdFNVTGh5R1dOSnJ3SmZTdkdaeERPT0hEenBBdHROb0dtZUhVT0dZZVdoUnd2Z0hpeU5aekNTcnF0SHRjT1NuSXdEVENJdGN2Z2NRdkJjY0RJdHVlcWRQQXhFSWdldF9BU0NJSXhDUGZDVnZva0J5SklTQWFNVGF1ckNjSkVrS0lOZ2tXek9FdGpqVklDVVpHdUNYZlZ4WUl6UE9ZcFhqVmdiSXNFckVGeXRGZXlqSW1GZ2F2dXlrWGxJeHpTQmxGQ2FoQ0ppZmd3WFFNY1VJU25yQ0pabVZBZnRrWnp6ekJESldGZUFPU1NoYkdqWEdKVmJ2cnRMV2ZzWkdKQ2tVVEd5amFhS0paTU1jRm9UY0VEdEh1UUpWUWpFSUxmY29KU0p1UUtzZ1dKeUxoRmVtY2FKRmRmdlNxckJ4eGZFakpORlNzc0RzREVyQWxvcWpKa2ZBU2duakd0cWxKYVh4eUplUGZycnZkbUptSnJlcEFZa0ZqRVdWZFJtSm9KY09laGhIUU1pbkpqakhIR3FCb2Fmb0pic3FwT3VYQWNtQ3hubnNKYU5KR2NNTlhFS1h0SllwUWFWZWFIQ0REdkpXWWZwSGlvV05IS21YZ2FBaVhQenNUS2ZGdlBZZkJORE5VVkttU09mbk5oTnZ5V0tWQmlTS1VIR3pJbm1kWktib2x5YUp4SU9jSHpLRXRUWXd2Tk5QVkx6S0dKVldmQUlvUVNJTFpLbmhxaGdDTUxmZFBZb2RIVnhQYmd3UExTZ1NqUUlSSGJqTGZUWWlEWEJHVkdNbUxoRWdyZ3NWQ1ludHJMb1VadVdLRE5sQ3ZMTWRLeElkVUZUZ3pMWllqQmlyeWVIc0hETWJ1ZkRBZ0d2Sk11SlNjbFlhV2NlZlBNdGZOQnFtRWtxaVd4WE1DZ0tmRElTZW1NbFZORk9DSlFPQlBqb013S2xxT3ZZUHZVaURQaVdHTm5TSXpMWWdZaVFUbU9LTkN6d3ZuWWpmU1hoU05XdnpFQnFkcGtQU2VWbmROV05uRW5yc0pXaGxhU1lOdWFsd3h0S1JQd2tuSGlOQ1ZKQlJka3h3aU5iSW5jRkRTVnFuak5TVGt1Q0ZCWEV6d1ptTlhPUUx1Q0JmTUF6cE52Y1hnWnhGS1FGT09iVXNYT1BLSmVHT1N5c3RlbS5JT3JacFV1emtXdlpscFJPR1paY3JNZEdtd3lVSExtU09iUkdrdnhrY3BSZk1VT3llRHVhZGNRbnNBaE9UVm1USndpTnJjWHdxT2x3YkhkdlNOZXlPeU9HU2JpR0ZHUG13b1BsZ25la2tQUENXVVRsS3JmU1BXZlJDYUNOYld6dWlQUWpiUFl5ZEJxa1hsUGtOc1JxckpveWxQRG93T3NySVNkQ1dTVG9QWFRxQklSWERPdlB6SkFDdHdNcEFRUEtlbXRTUU5JYnJsRGJRTWFvU256aXlobVFuVlBzVWVtYU5UWlNScElDZHBtQXJoVXFWUlZKZHZ5Rlp2enJSVldIU3dnWGZ5TU11UldUZlVjRFVPRnlSUEZjc1FpSFB1anBIUHlSZ2VBd0VMaGZ4amhEU1VQdWxyUGF2VEF5aW1GU1VCdlRZcnFBbXR0V0hTTHlrVU1iQlplWnJKU091WkFqdHlMdGlNa2VTc05iRU9semhlaVNOWnNCd2RWVEJvU2NZZ25WbXVyVnNTUm9vVVZVaFNUVFpzU2NJVFJQQ2VWdW5GQlR4ZkRwVlRseEJnYUVYT1RxTEVFdHF1VlNOUVRTY2JYZ01iRnZiZ1NUbUlxR0VuY2NLUXF0VHhTVEVmS1RQZG5Ha0pZV1R3Wm1vZ1pCc1FqVEhXaG9rTE1abUNjYlVMVVNpaUVQblNrSVVhVUhZZ3FaQ3VRY2ZpVUhRTUxnRGdDTW1sVVJ3c01id2lua29VQ1pTY2hOeUdnclV5UlpXdEROS2d0d1VqSVZNRlFIa09FS2d5RlZ2VkhacGNLVVpHVlpua0RYb09uemJaUEhWZ2V0X0lWc2V0X0lWR2VuZXJhdGVJVldYakZBcGViYm1MVlRub0xJcXJ2eXFtak9WQWVsV1VUZXdyZW5QVkdDcVNvRmVORVJWR2ZrTlNLQ2phVFZ3bVhyTnFYV2NOS0JkVlZYWG9ITEV5Wm5kVlRZSUtqTmpQeFRFTlVtVlhybGVyUk1SdFlwVmZYa2pXQnZ3SHBkbVFHdFZ6clpqZG1CbXlWT2l4RFZaZmlJV1hUZmdlaVdUZEZ0VFdEbm1xb3ZPZ3JpcGtVV0lHeWF0cWVLWmRadFpXS21Kd1NuV1ViWm9QQmRXU0psS1NYQmRIVGhXVnZoYVFLc1liVW1CaVdyR2tRRmtzdFBpV1ROdFBPUVVkcUVIdXVXdlBOZlZOeWhMUEZnSUNYRVpqZ2dkSUlTWE1GWFVMTVJvdlpQb1NYd3NlR2dzV2d1VEVaWEdmSGlnQWRLTmNnWG9yTktqSW9hUnV0WEV2T1VHQnFGZkdZRVFqelViSk5YYkxSQUtZd1BuR0xDU0VnWlJUS1lzWk5GR1ZFTHB4QXZmTVlpeUlNeHd4U293WWdQWXhrRlFobExtS2pUVFluREJlS1BHVmxQZll4WWNXS2VPelNMd0lyWVNtenFsQkVHVmtDeVlvUUlkUVBwUmZlSFpzcmNkelFEUFpyTE12SVpxYk9TbmlmQ0RrRU9aVXVibXpNaHFjUnhPWk9JY2x4SXR0U1ZaZVhNZlpnZXNYd0tjWlhUV25iS2NZWmF2dGZaT1RpTVBnRXJvWnZhbHVlX19KdUF5QWxYekxWcUpDYW1tTEJuSXZBS29MSGFsQkVFUmlEdU5QV2FpYXpIYVRPblduYURJZkV5ZmVoQnBhVmZwb3ZudENjTWVWQkFiYkpTdGFQRmJPQWJKbUpIdEZSd3BCYmZRRHBFWnhkUGhoSEViVnNSZHFXU0dOVHNPYlFKbXdwbXNhb2V1elNhYm1zY29ybGliYVpFdXpWRGRiRkhvYmFJaFR3dkpqcUlmWlNyYmdhTmxvVlFBZ091c2JWRmdMUklSVXV4dWJwbUVRa2RUSnRQUFFTd2J2S1VhWXdEb3RSV1dKY25GQnFRbFpUZll6RGJjeElUdXJQa2ZGSnJiY3ZhbGVMWHR6QWlaaGNTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpY01pY3Jvc29mdC5WaXN1YWxCYXNpY3R1d1VDUkR2aE14a2NnZXRfU2VuZFN5bmNmZVVrQnhpWXdjR2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkR2V0UHJvY2Vzc0J5SWRQRG9JR1dxdWN0RVFkRW5kUmVhZEJlZ2luUmVhZFRocmVhZExvYWRTSEEyNTZNYW5hZ2VkZ2V0X0Nvbm5lY3RlZGdldF9Jc0Nvbm5lY3RlZHNldF9Jc0Nvbm5lY3RlZE1lbEhZZHpsaGRnZXRfR3VpZGFDd3poQ3RkeVdXdWlBamQ8U2VuZFN5bmM+a19fQmFja2luZ0ZpZWxkPElzQ29ubmVjdGVkPmtfX0JhY2tpbmdGaWVsZDxLZWVwQWxpdmU+a19fQmFja2luZ0ZpZWxkPEhlYWRlclNpemU+a19fQmFja2luZ0ZpZWxkPFBpbmc+a19fQmFja2luZ0ZpZWxkPEFjdGl2YXRlUG9uZz5rX19CYWNraW5nRmllbGQ8SW50ZXJ2YWw+a19fQmFja2luZ0ZpZWxkPEJ1ZmZlcj5rX19CYWNraW5nRmllbGQ8T2Zmc2V0PmtfX0JhY2tpbmdGaWVsZDxTc2xDbGllbnQ+a19fQmFja2luZ0ZpZWxkPFRjcENsaWVudD5rX19CYWNraW5nRmllbGRDWWR6dU5xVFNMY21kTlRIY2piTFFteW1kQXBwZW5kUmVnaXN0cnlWYWx1ZUtpbmRSb3VuZENvbXBhcmVNZXRob2RtZXRob2RIRURzWFRtc1ZBZUVyZHlJdE5sQWpPSm5TcmRDbGlwYm9hcmRoeEd6UUFCYk9xS2V5cXVqREN4VXpydVlYZVJlcGxhY2VJc051bGxPcldoaXRlU3BhY2VDcmVhdGVJbnN0YW5jZW5Db2Rlc2V0X01vZGVGaWxlTW9kZVBhZGRpbmdNb2RlRW50ZXJEZWJ1Z01vZGVDcnlwdG9TdHJlYW1Nb2RlQ29tcHJlc3Npb25Nb2RlQ2lwaGVyTW9kZVNlbGVjdE1vZGVEZWxldGVTdWJLZXlUcmVlZ2V0X01lc3NhZ2VFbmRJbnZva2VCZWdpbkludm9rZUdldEVudmlyb25tZW50VmFyaWFibGVJRW51bWVyYWJsZUlEaXNwb3NhYmxlVG9Eb3VibGVnZXRfSGFuZGxlUnVudGltZUZpZWxkSGFuZGxlR2V0TW9kdWxlSGFuZGxlUnVudGltZVR5cGVIYW5kbGVHZXRUeXBlRnJvbUhhbmRsZVdhaXRIYW5kbGVUb1NpbmdsZURvd25sb2FkRmlsZUlzSW5Sb2xlV2luZG93c0J1aWx0SW5Sb2xlZ2V0X01haW5XaW5kb3dUaXRsZWdldF9NYWluTW9kdWxlUHJvY2Vzc01vZHVsZXNldF9XaW5kb3dTdHlsZVByb2Nlc3NXaW5kb3dTdHlsZWdldF9OYW1lZ2V0X0ZpbGVOYW1lc2V0X0ZpbGVOYW1lR2V0VGVtcEZpbGVOYW1lR2V0RmlsZU5hbWVnZXRfTWFjaGluZU5hbWVnZXRfT1NGdWxsTmFtZWdldF9GdWxsTmFtZWdldF9Vc2VyTmFtZWdldF9Qcm9jZXNzTmFtZUNoZWNrSG9zdE5hbWVEYXRlVGltZVdyaXRlTGluZWdldF9OZXdMaW5lQ29tYmluZVVyaUhvc3ROYW1lVHlwZWdldF9WYWx1ZVR5cGVQcm90b2NvbFR5cGVHZXRUeXBlU29ja2V0VHlwZUZpbGVTaGFyZVN5c3RlbS5Db3JlTWV0aG9kQmFzZUNsb3NlRGlzcG9zZVBhcnNlU3RyUmV2ZXJzZVg1MDlDZXJ0aWZpY2F0ZUNyZWF0ZU11bHRpY2FzdERlbGVnYXRlR2V0S2V5Ym9hcmRTdGF0ZVNldFRocmVhZEV4ZWN1dGlvblN0YXRlU2V0QXBhcnRtZW50U3RhdGVHZXRLZXlTdGF0ZURlbGV0ZUNhbGxTaXRlV3JpdGVDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZURlYnVnZ2FibGVBdHRyaWJ1dGVDb21WaXNpYmxlQXR0cmlidXRlQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZUFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZUFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZUFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGVEZWZhdWx0TWVtYmVyQXR0cmlidXRlQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZUFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZUFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlQXNzZW1ibHlDb21wYW55QXR0cmlidXRlUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGVzZXRfVXNlU2hlbGxFeGVjdXRlUmVhZEJ5dGVXcml0ZUJ5dGVEZWxldGVWYWx1ZUdldFZhbHVlU2V0VmFsdWVnZXRfS2VlcEFsaXZlc2V0X0tlZXBBbGl2ZVJlbW92ZXNldF9CbG9ja1NpemVnZXRfVG90YWxTaXplZ2V0X0hlYWRlclNpemVzZXRfSGVhZGVyU2l6ZXNldF9TZW5kQnVmZmVyU2l6ZXNldF9SZWNlaXZlQnVmZmVyU2l6ZXNldF9LZXlTaXpla2J3UWhNaUFrSWZEV2VRbWRobXljb21LZlNpemVPZmRCT3Joam1ibFJmWXh2TVZhaUl5VmZ2dWlIcmllUHF4TGp0dmFmTE5pYlROV0xrVlVsZmh0WlN4c0RraW1mRlhHcnZlY1RvcGZwT1RHWEhrS3lmelR4YXRQR0JTeWZFZ1hwc1Vhak5uSVBzSUhnTENiS3Zjb0VLZ2dFdUVLc0ZKTFNrUWdDcnlwdG9Db25maWdNT3lVbkFmVnRtTk9qZ2dldF9QaW5nc2V0X1BpbmdTeXN0ZW0uVGhyZWFkaW5nc2V0X1BhZGRpbmdhZGRfU2Vzc2lvbkVuZGluZ1VURjhFbmNvZGluZ1N5c3RlbS5EcmF3aW5nLkltYWdpbmdTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nRnJvbUJhc2U2NFN0cmluZ1RvQmFzZTY0U3RyaW5nRG93bmxvYWRTdHJpbmdUb1N0cmluZ2dldF9Bc1N0cmluZ3NldF9Bc1N0cmluZ0dldFN0cmluZ1N1YnN0cmluZ1N5c3RlbS5EcmF3aW5nZ2V0X0FjdGl2YXRlUG9uZ3NldF9BY3RpdmF0ZVBvbmdzZXRfRXJyb3JEaWFsb2dKb1hmS0paQUZxUFZac2dpdU5YTHZad3ZFeGdMS3dRRllaVHN2RFlDaFZ2RGt5UExXYkF3Q2hKd2tFeGp0ZEdoc3hSc3RUcmZTWGJWaGF6VXhlTk9Cd2tWaGZDT3hNRmJaQ1ZTWFJHWmhaUE5vRllRaEl3aWh3TExpR2JIYk5GcGhWWFVxc2RuWHpwaENvbXB1dGVIYXNoVmVyaWZ5SGFzaEZsdXNoTWF0aGdldF9FeGVjdXRhYmxlUGF0aEdldFRlbXBQYXRoR2V0Rm9sZGVyUGF0aGdldF9MZW5ndGhFbmRzV2l0aEJnUG1YUGtudUl6bGh1aE9IdkNSdVhqdGd3aFNPd1Z4VGRQcVNhUG56aFJUd1pnckRvQmltSVJOb1VGYWJoRmlnT1NzRXlvUkFOaXJuVHJzZEd4Z1JpelJvRVVzVWtJT3dSa1dpQUhobWdzRHhNTmtpZUp4cmdPU3Z0a2lGWGFiVHhpR0pxaWxyREdrUWpNU3FpbG94dkVXekF3eGlLblNKQmpqZEZqdXNJbklBemJKaVZDSGpTSkpGbkdxRUFManRRdUpGWHJjSVZSak9KbnJUeXJBcE55VGp6QkhFZk5JU1htUGtqSVR3VUtRQ0t3dmptUGh2aGdXa1ZFa0xobldXZVhKTWFjRWtkQW51Y0NGRERHa2dSSEdvVVFXRnBoSWt2Rk9GZmJ5WE9rcGRpVmRtb1hha0FzeW5jQ2FsbGJhY2tSZW1vdGVDZXJ0aWZpY2F0ZVZhbGlkYXRpb25DYWxsYmFja1RpbWVyQ2FsbGJhY2tjYWxsYmFja1JlZ2lzdHJ5S2V5UGVybWlzc2lvbkNoZWNrRmx1c2hGaW5hbEJsb2NrSFlmZHlkbGhLSHZka2hVRWRxU0x5Y3RNa2t5U1hGa01xR0FBSkxQdHBrb1hpZlV5dXNCbGlPQW5sTG1NWURsendYemtUZFFGbGVxS09UZHJqWFBHbHppVGJOQkxMZFpGVW1LbGlYQnlzSkREUmpWbHR4Y2VzQUNCcFdsUnRsU2V0UHJvY2Vzc0lzQ3JpdGljYWxNYXJzaGFsTmV0d29ya0NyZWRlbnRpYWxTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsV2luZG93c1ByaW5jaXBhbGdldF9JbnRlcnZhbHNldF9JbnRlcnZhbFROaXZDa1l1UG15YmxwUWxYVHFmaGdXaWVsa2VybmVsMzIuZGxsdXNlcjMyLmRsbG50ZGxsLmRsbEtpbGxQb2xsUW1wUU5lbE54ZHRqZnJsek5HaXZnSlN1bGNwS2lKektvZHpsV3ZPdUNlVk9qemNFbVdOUUh4Q0lXYU5rSW1kZG1WQ0J4YlpBVG1CZm9KRFZCR0VXbVJyeFpLTktsU1FYbUZpbGVTdHJlYW1OZXR3b3JrU3RyZWFtU3NsU3RyZWFtQ3J5cHRvU3RyZWFtR1ppcFN0cmVhbU1lbW9yeVN0cmVhbWxQYXJhbXdQYXJhbWdldF9JdGVtZ2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW1TeW1tZXRyaWNBbGdvcml0aG1Bc3ltbWV0cmljQWxnb3JpdGhtSGFzaEFsZ29yaXRobWNOblRPT3FGWUZlUGltVHJpbVJhbmRvbWZXc3dic3RucW1JQ3J5cHRvVHJhbnNmb3JtRW51bU9YeGJSd21QakZZclpDbnBMYWdRZU9pU2xzR251YmhEdkNqSnN4TG5tZ1NadGNHQ0l6TW5jZ0JjelRWZXJEUm5CWnZJUHBrVVVLWW5Ub0Jvb2xlYW5UaW1lU3Bhbm9JWGdIamNIcWlLaW5NYWluWDUwOUNoYWluQXBwRG9tYWluZ2V0X0N1cnJlbnREb21haW5Kb2lubWZTQWpuaGVmQ3JsbkdldEZpbGVOYW1lV2l0aG91dEV4dGVuc2lvbmdldF9PU1ZlcnNpb25TeXN0ZW0uSU8uQ29tcHJlc3Npb25BcHBsaWNhdGlvblN5c3RlbS5TZWN1cml0eS5BdXRoZW50aWNhdGlvblN5c3RlbS5SZWZsZWN0aW9uWDUwOUNlcnRpZmljYXRlQ29sbGVjdGlvbk1hbmFnZW1lbnRPYmplY3RDb2xsZWN0aW9uc2V0X1Bvc2l0aW9uQ3J5cHRvZ3JhcGhpY0V4Y2VwdGlvbkFyZ3VtZW50TnVsbEV4Y2VwdGlvbkFyZ3VtZW50RXhjZXB0aW9uWGFHTXpYQ015SW9GZG5xcUtwUXJib0ltYWdlQ29kZWNJbmZvTWV0aG9kSW5mb0ZpbGVJbmZvRHJpdmVJbmZvRmlsZVN5c3RlbUluZm9NZW1iZXJJbmZvQ29tcHV0ZXJJbmZvQ1NoYXJwQXJndW1lbnRJbmZvUHJvY2Vzc1N0YXJ0SW5mb0dldExhc3RJbnB1dEluZm9QQUJLaWpxdGpvS1RrRXRJRGd1Z3BvTU1NcGJpTkNzcW9maW5GQkFrcEpOYnJvWmVyb2tsb2Fzb213VHF4SG9ZcEZWdG9STE1xWmJRSmdCY2F2b3BYaWR3SGhxcWRGdHpvTG1JcUZnemtCcHF5a2JtY1FNS0lwaWRyV01CbGh4bWR5bWdQcFVQS3R4VUtjVWJwU2xlZXBpaklFdFJjekRVQUNocFZLbWNobURqZmlwQ2NUeU5GWmx5TFRrcFB4T2dqZnZXUFVrcHFRQ3pwd0FFVk1vcE1pY3Jvc29mdC5DU2hhcnBYQVRLWml5QUF5UHFqdXhoWlVLaWlVdmpxU3lzdGVtLkxpbnFVUXlyZGRCaXlucVRiU0lPWVpSZkFoRVZQU3JxUEtaSlpEblBzcUVjTFhlalB2dnFzZFNqc1RwWVh3cXVTclFoTFB3WExhSFFCcnRGTVJIQnhtcWFFY0hySUZwV3p4d3BxZklyWk94a29SZkN2V3V0TnJibVpnT0ZObUZ0VmpyWHJZRVRDSERrclhBUUNacmN0ZHZPc1FEc0JhckNsZWFyQ2hhckludm9rZU1lbWJlck1ENUNyeXB0b1NlcnZpY2VQcm92aWRlclJTQUNyeXB0b1NlcnZpY2VQcm92aWRlckFlc0NyeXB0b1NlcnZpY2VQcm92aWRlclN0cmluZ0J1aWxkZXJTcGVjaWFsRm9sZGVyTWljcm9zb2Z0LkNTaGFycC5SdW50aW1lQmluZGVyQ2FsbFNpdGVCaW5kZXJnZXRfQnVmZmVyc2V0X0J1ZmZlcmdldF9Bc0ludGVnZXJzZXRfQXNJbnRlZ2VyTWFuYWdlbWVudE9iamVjdFNlYXJjaGVyU2Vzc2lvbkVuZGluZ0V2ZW50SGFuZGxlclRpbWVyVG9VcHBlckN1cnJlbnRVc2VyU3RyZWFtV3JpdGVyVGV4dFdyaXRlckVudGVyQml0Q29udmVydGVyVG9Mb3dlcklFbnVtZXJhdG9yTWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3JTeXN0ZW0uQ29sbGVjdGlvbnMuSUVudW1lcmFibGUuR2V0RW51bWVyYXRvckFjdGl2YXRvci5jdG9yLmNjdG9yTW9uaXRvckNyZWF0ZURlY3J5cHRvckNyZWF0ZUVuY3J5cHRvckludFB0ckpvcXliUHVyWUtWQ3NIZXFHTmNGaGpTRUVzZmpUbm51YnVwY0pzZnhoVEZuZVp2VUxMT3NaZERHTGFvblJzRm5Qd3plU3VXc1N5c3RlbS5EaWFnbm9zdGljc212aURVZ2lnb2NzRnJvbVNlY29uZHNHZXRNZXRob2RzTWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXNTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXNTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzRGVidWdnaW5nTW9kZXNHZXREaXJlY3Rvcmllc0V4cGFuZEVudmlyb25tZW50VmFyaWFibGVzR2V0VHlwZXNHZXRQcm9jZXNzZXNHZXRIb3N0QWRkcmVzc2VzU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5YNTA5Q2VydGlmaWNhdGVzUmZjMjg5OERlcml2ZUJ5dGVzUmVhZEFsbEJ5dGVzR2V0Qnl0ZXNCaW5kaW5nRmxhZ3NDU2hhcnBBcmd1bWVudEluZm9GbGFnc0NTaGFycEJpbmRlckZsYWdzU3RyaW5nc1Nlc3Npb25FbmRpbmdFdmVudEFyZ3NJQ3JlZGVudGlhbHNzZXRfQ3JlZGVudGlhbHNFcXVhbHNTc2xQcm90b2NvbHNTeXN0ZW0uV2luZG93cy5Gb3Jtc0NvbnRhaW5zU3lzdGVtLkNvbGxlY3Rpb25zU3RyaW5nU3BsaXRPcHRpb25zZU9ERW1icXVLZk11cXNnZXRfQ2hhcnNHZXRJbWFnZURlY29kZXJzUnVudGltZUhlbHBlcnNTc2xQb2xpY3lFcnJvcnNGaWxlQWNjZXNzR2V0Q3VycmVudFByb2Nlc3NJUEFkZHJlc3NTeXN0ZW0uTmV0LlNvY2tldHNzZXRfQXJndW1lbnRzU3lzdGVtRXZlbnRzRXhpc3RzS2V5c3dRa1dhcXlIeURSdGNTalZxRnVYZFpUdGZPa0V4Tkxjb0F1VnRqbnpGcEpYU0traUhhdENvbmNhdEltYWdlRm9ybWF0Z2V0X0FzRmxvYXRzZXRfQXNGbG9hdE1hbmFnZW1lbnRCYXNlT2JqZWN0b2JqZWN0Q29sbGVjdENvbm5lY3RTeXN0ZW0uTmV0VGFyZ2V0U29ja2V0U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLlJlc2V0Z2V0X09mZnNldHNldF9PZmZzZXR6Q1pWVHlXU2RJYVV4ZXRvcF9FeHBsaWNpdFNwbGl0RXhpdG5ZZm1DdWdiUldObHRJQXN5bmNSZXN1bHRyZXN1bHRUb1VwcGVySW52YXJpYW50V2ViQ2xpZW50Z2V0X1NzbENsaWVudHNldF9Tc2xDbGllbnRnZXRfVGNwQ2xpZW50c2V0X1RjcENsaWVudEF1dGhlbnRpY2F0ZUFzQ2xpZW50U3lzdGVtLk1hbmFnZW1lbnRFbnZpcm9ubWVudFN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvci5nZXRfQ3VycmVudEdldEN1cnJlbnRDaGVja1JlbW90ZURlYnVnZ2VyUHJlc2VudGdldF9SZW1vdGVFbmRQb2ludGdldF9Db3VudGdldF9UaWNrQ291bnRnZXRfUHJvY2Vzc29yQ291bnRFRlhuU014S29Gb3RHZXRQYXRoUm9vdFBhcmFtZXRlcml6ZWRUaHJlYWRTdGFydENvbnZlcnRGYWlsRmFzdFRvTGlzdEdldEtleWJvYXJkTGF5b3V0U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLk1vdmVOZXh0U3lzdGVtLlRleHRSZWFkQWxsVGV4dEdldFRleHRTZXRUZXh0R2V0V2luZG93VGV4dHZaWUREcUFRa3h0Q3VGY2RTUG5lS3l0bWRGSG9SQXFzRnp0Y2R4R1NaS3hsWG5FdVBteElidFZ1Wk5JdWJFeG9QbEVyaFRLdVhRZERYSFlNZWxSVVJMdW5NTlpaWkhrQkRnTXVlYlpBeG9HZ09RdVVFeFFZVkhjUXVNUldBeU52Q3ZQdnVjWldaZE94REZldUdoRnZYWGNUdHhOVVF0YWlLdlZYQ2hkbndGZUpyV3ZUWm5Hc0J2cll2ak5ERURXSW96VGV2Z1NOUUt5d29CS1ZWcXZXYU9kVHF3Snd2Qk95SURIc0FseEZ6dlJneEZJWXB6b1B3TE9waHJ5dEhLaXdwYlpZYld3S2l3Y1NXUHpGUVFsd0dldEZvcmVncm91bmRXaW5kb3dzZXRfQ3JlYXRlTm9XaW5kb3dNSnlXYmpydElyeWp3d1RvVW5pY29kZUV4VW5ob29rV2luZG93c0hvb2tFeFNldFdpbmRvd3NIb29rRXhDYWxsTmV4dEhvb2tFeFNCZ2JVa2tublN4UWtXckhCekh5WGpjVHhhZENyWVBTa1V4S0h0b2xzaGtrWnhIVGFteG1ETmdheHdlYm9XYnpiZEVtcWN4VXh4bHJaVlFVRGNiRWV4TXV0ZXhJQU9BakFqdnpWdmh4ekdrWFJHQlVCblhueFdOSGdOVGRqeHFuU0N5bXVtZ1FHd2ViaHlHSXlPb2J2aXBxZ2RrTVJ5a1FiZ2lXanJDRXpYeUluaXRpYWxpemVBcnJheVRvQXJyYXlnZXRfQXNBcnJheWdldF9LZXlzZXRfS2V5Q3JlYXRlU3ViS2V5T3BlblN1YktleWdldF9QdWJsaWNLZXlNYXBWaXJ0dWFsS2V5UmVnaXN0cnlLZXlTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5SmZ0eWNOQ3ZwSGl5RlNCZEhtWUZreUFrUXhIdERQRWx5QXNzZW1ibHlBZGRyZXNzRmFtaWx5aldBTnp6a0h4TnB5ak9leU1sbUZpbnB5QmxvY2tDb3B5cGdFRmJiSG1xeWJIZVVkaHlHRVFyeVRvQmluYXJ5Z2V0X1N5c3RlbURpcmVjdG9yeVJlZ2lzdHJ5b3BfRXF1YWxpdHlvcF9JbmVxdWFsaXR5U3lzdGVtLk5ldC5TZWN1cml0eVdpbmRvd3NJZGVudGl0eUlzTnVsbE9yRW1wdHlTV0poRFlEUnl5cldYbnpSRmZXVERRelhQb3lxdXJIeFNhUXpoZlJVa0JhbGNPWUFLaVV6c3JhSllkWVRBYXp3ZktZTU5qWWxNWWd6R2JrZkJ2elNuZHJ1eldyYXBOb25FeGNlcHRpb25UaHJvd3MxLjAuMC4wLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjZGcmFtZXdvcmtEaXNwbGF5TmFtZS5ORVQgRnJhbWV3b3JrIDQuNkl0ZW1fQ29yRXhlTWFpbm1zY29yZWUuZGxsPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIFdpbmRvd3MgVmlzdGEgLS0+ICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSIvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz4gICAgICAgIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+ICAgICAgICBXaW5kb3dzIDEwIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz4gICAgPC9hcHBsaWNhdGlvbj4gIDwvY29tcGF0aWJpbGl0eT4gIDxhc212MzphcHBsaWNhdGlvbiAgeG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIiA+ICAgIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgICA8ZHBpQXdhcmU+dHJ1ZTwvZHBpQXdhcmU+ICAgIDwvYXNtdjM6d2luZG93c1NldHRpbmdzPiAgPC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5Pg==45:T558,OTNmZytRWUlHeHJudm1nRzNEQ29mL3V2VDUvbGprdDJpdnRjSEcwenhwR2RoSnc1M0FWcUJYc0RNRWttZzhWK2s0dTdFS3h6a2pUVEprTElwQTV3MHZSRzVtU2lPS0RPZmxibGJkOFJudzN1aWVLdEwwOUhyTVVMM2dPTVYzSnBOZTNpVVd4VVBDNHFPeGZTcS81V3VwWmdpWXFQc3VkNUlzaUcrMGtUVG11K1hXSU5qSXliNHVzWEVORzlGaFcrRlRkQTY2V2pXbHk5TlJydzJMdWlRY3hodE1uRVNqK1FmNnlkazExYnhXMzZLeitQc1pxRnVDTTVjdGVmUTdQWXREVnEzSm42VlFkWGtHUFEyQ0FhWmdISGdudUt5cU5sUCsvV3p5RFpGN3NMRzNnRU1TZzhQMFVPRFJ0Y2N2cmI3VnoyYUZhd2dJSjJKNTJKaU1uOVQ0Qmp2aStOSlBPWjdPbWYzZGlUL0huSnR1YlU3dkFhcEFHeEJjSG1OY2RibFlHSjloWGREZFlBeVBhZTlWRHhSdHE3OHlCbWNSQXJvSDQzSTFPNXUwS1JaVDV5UDVZbFFiT1hMbUtkN1UrMVZ0TnpkZVJPNm1TcVp0OWVIS2gxbDVJd0pwdHF4N1BsaXJHVWhlNHN4TWE0Z2FPb2R4N1BlRHpzT0VUT1k3ditvTTQyU1dQU0dWdlJuM1lPTld4QldocW1mRU5wNWlTRFUzeVJGMTVaNkNQd0tvNElQYlYrRStsTHBLWXRiaXVyWVlkZmtpTjcra1lOdGxhTlNXcHZLNkJWRnhLaURxazZ1azlqOGRhaVpNZzBPQ3FZNzhOektFZlY3WTRjOHpRWVBmemNONy9tWnBRdk9XdVFVakR0ZURhVU5XcDVjWlpOMkxOcDV2YmNTRTRKYXlHR1BSUlRlREN6SlZtYlpYYlUxbEpKYmpUMWZ4LzhIOHJ6L2ZpNDlHNjhqRUpzN2NxV1NScmcycmpHL3RWTlU3NFZqOW9PTU9zQkhFcFNUYlhHMzlsYjJzL2tkS21iWUZmOUJIS0lpeE9XZ1Bvb1RrWGN0VytLQXkwaVYvUW5wM2d2cTdGelErNUZSWC85Y3RYNmJvNlBhNG5wdEJhTkF0MkZEU3NMT0JMSHAzNG1saUx3ZVZLVStXME5FajRDU2J4TGc2cXFZenF0MW51cHB3cjViVFJ0TjV3cW5KdkE0U3Q1SHg0QW5sejVwK2RXZWFXU294a3JhRktOU1g2K3FROUROSnFpbXUzdUdiL00yTnBKa0VKbm8yTEZHV2ZBclU4RWxWT1ZHUXhVYnhkR2RwOC9ObFBHQWxpRk5DUW0zK1F0eGNGRUFOZVBMSWVJeEpCUw==46:Tc3c,OTNmZytRWUlHeHJudm1nRzNEQ29mL3V2VDUvbGprdDJpdnRjSEcwenhwR2RoSnc1M0FWcUJYc0RNRWttZzhWK2s0dTdFS3h6a2pUVEprTElwQTV3MHZSRzVtU2lPS0RPZmxibGJkOFJudzN1aWVLdEwwOUhyTVVMM2dPTVYzSnBOZTNpVVd4VVBDNHFPeGZTcS81V3VwWmdpWXFQc3VkNUlzaUcrMGtUVG11K1hXSU5qSXliNHVzWEVORzlGaFcrRlRkQTY2V2pXbHk5TlJydzJMdWlRY3hodE1uRVNqK1FmNnlkazExYnhXMzZLeitQc1pxRnVDTTVjdGVmUTdQWXREVnEzSm42VlFkWGtHUFEyQ0FhWmdISGdudUt5cU5sUCsvV3p5RFpGN3NMRzNnRU1TZzhQMFVPRFJ0Y2N2cmI3VnoyYUZhd2dJSjJKNTJKaU1uOVQ0Qmp2aStOSlBPWjdPbWYzZGlUL0huSnR1YlU3dkFhcEFHeEJjSG1OY2RibFlHSjloWGREZFlBeVBhZTlWRHhSdHE3OHlCbWNSQXJvSDQzSTFPNXUwS1JaVDV5UDVZbFFiT1hMbUtkN1UrMVZ0TnpkZVJPNm1TcVp0OWVIS2gxbDVJd0pwdHF4N1BsaXJHVWhlNHN4TWE0Z2FPb2R4N1BlRHpzT0VUT1k3ditvTTQyU1dQU0dWdlJuM1lPTld4QldocW1mRU5wNWlTRFUzeVJGMTVaNkNQd0tvNElQYlYrRStsTHBLWXRiaXVyWVlkZmtpTjcra1lOdGxhTlNXcHZLNkJWRnhLaURxazZ1azlqOGRhaVpNZzBPQ3FZNzhOektFZlY3WTRjOHpRWVBmemNONy9tWnBRdk9XdVFVakR0ZURhVU5XcDVjWlpOMkxOcDV2YmNTRTRKYXlHR1BSUlRlREN6SlZtYlpYYlUxbEpKYmpUMWZ4LzhIOHJ6L2ZpNDlHNjhqRUpzN2NxV1NScmcycmpHL3RWTlU3NFZqOW9PTU9zQkhFcFNUYlhHMzlsYjJzL2tkS21iWUZmOUJIS0lpeE9XZ1Bvb1RrWGN0VytLQXkwaVYvUW5wM2d2cTdGelErNUZSWC85Y3RYNmJvNlBhNG5wdEJhTkF0MkZEU3NMT0JMSHAzNG1saUx3ZVZLVStXME5FajRDU2J4TGc2cXFZenF0MW51cHB3cjViVFJ0TjV3cW5KdkE0U3Q1SHg0QW5sejVwK2RXZWFXU294a3JhRktOU1g2K3FROUROSnFpbXUzdUdiL00yTnBKa0VKbm8yTEZHV2ZBclU4RWxWT1ZHUXhVYnhkR2RwOC9ObFBHQWxpRk5DUW0zK1F0eGNGRUFOZVBMSWVJeEpCU0dLbkRiSm9xNnJ6S3pTOS9WNFRiWllYdTZHNVNhZ0ZUc2xMR1BrRXREdUJLSUN5MzRjdDFyS2V6NDZXK3VSVDY0UTF5UzRDQ3RRbk5DN0VYSDhZWnVMdGxidTBjRGlEbGRHSFRUL1NuYkttaXZLVE40ckh5Nk1nWTFVU3U4WmhrcWtwZkZPOFFrMW5WVG1aTnpKMGp2NkRoQklhaGNJWG10WDh2cTZ3T1FFZTJFQ3JZM29zQWdjT2lJYVpnTWNuZ0s4WUlKODlKMStQL2h2K3RYUUd4YWRiZVJIdGxvOFExcUp6dCs0cjlrVmdKN001VTEwcXJLdmlFeGpwWEtkc3VEZFFzQ2ZhcnVoU0ZVL0t3OTROZ2YyNFhqMlVoMEJWV1BFbVM0TFZrdmx4YU9ONmlMN2JrWENNMHJmTG1wbWpmaE00YUpleFB1ZmNicTYwR3FBYklJMWViL2RIUVRSV2tNd2FBS2NVQ0tLNGp3ZEExTGp0MlRScnFBeVAvQk8wWnM0TTNNUXBaSkZ6ZFA1WjZZOHU3WnVyTndobTRUTlZxVnBRK09XZTR5UkxkNXBCL3hJT1Y5dVV0M0ZEVkhaVjB6K2NuUURJbWp6S3FpRlI2OVQzc1hFeUx0QmUwek5GNmRQNVhaLzBMZDlhSlBweG9oeFNjS3hoU1hQMDZlTUpmWExzQmRmNGZWcnJocTJnanlSeElicTZxU0ZEbHR3VDlDZzk5b3V2ZmgwMEZMSUtVNy9ocmF2aTlBMzVxd2ZsV2EzMENKZXhyM25XcXN4YlZnbGxlMm9CZzQ3V2tQWTRNejhkWkN6YlEvTHA0TlpYZHE3SkJKOEZHNTdvS1RpSmpSQktkL2VCZTlYVEJsQ0FvQXF4ZzkyZVFCZ1V0SmZCMUJGRi8yc0oyb0VJVHRDeUY0bWRkMnc1UFJGUm5EV2g1Yy8yRjJlYkFNby9LeXpyVTZYNEhNRlJyY3diVXVDbFY3NS9tQnlzVFZXMW9saU0rY1ZnZUtQTWdObVJqeVluS1VlSzVZN29VZ3M1QURkV3hveWVVR2VIekdCYTJxWjFmOHZRTXR1eU4wZVNBMWIrL2pIdmVvK29vR0wvelVqVDhDOVBpVFRqUmpNaEwxeEN4eWVINHdzTnp1blg2d0tRbitjZDkyNHJoMENHS08xRngxMXdscGQ2ZWFCKzluM0NRaDFDWTdFMGtIVzQxR3NXWUZPNm8yeDNlSnpuekJSK0wxZTJhQzhwUkRtblRhbXl4SmQwVlJHMVdiVi8vOWROY21zZE1UMnVqWGg0VFQvM2VxYngzdnJnbG1EV2YzWTBtQVdUVnV3bEhGTzdrNTVhOXJINTVZYTBSL0hta1RXeWI2NExNUldJMVhQcGorYUVuUnI5VjJlYXNnQjRJaHhTZTRaVms3YmVYWW1oQjBqN0wyRWJiMG5KZGZuaFVPMXIxbG9aL0VXZDVQSkJUYlVVWDJBMFFTMHpacGZXaUZhOVMvQkRoWnArVi9OdkdINVJnVzVlSWpCRk9yV3JKVW8zSzZvdWk4emRSREJ6aXZwZFhXMXArS25qMHBxUU1GbnlqMXc2c2pIdUNZUHFGclhsR3BXNnFoZzNiQzlwQ3ZnV3JGbm5mOExPSGFaYXhRQjRZK0sxYVJkcVFrV0l3K0FJS2EzR1QySGlBWUpJNE5PY09Ta2piZ2ViazRUa1JNRFFGVE9iMEFtamFpRGZMNmpTRXdVZEdKTGoxdEZJaWxnNFRjdGg2VFZURDkwYz0=47:T504,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIFdpbmRvd3MgVmlzdGEgLS0+ICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSIvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz4gICAgICAgIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+ICAgICAgICBXaW5kb3dzIDEwIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz4gICAgPC9hcHBsaWNhdGlvbj4gIDwvY29tcGF0aWJpbGl0eT4gIDxhc212MzphcHBsaWNhdGlvbiAgeG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIiA+ICAgIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hl48:T520,ZENqeVBjSWgwcCtweTdTeHVvaUw1QzhpVDROK0RBRndYSVRtK2ZYem5vNVl4ME83clduRHJlZ2IzOHNSY1lFaFk5Yi9WWFVIU2xobERZTDBodTQ5TjV0R2NxNldoekNCcHZMdGticHlVYUNaVEZlNUYxeERpOHpoZEVhbk40NEZZVldiSTRNUHVZQVBUcWFnNjllM3o0SENnYzFCNlFZWmhCbUg3UXdidnVXclhrb2sxNFI5SzlEZzBoUzROWldXL1ZOWWdZK3c2bkErSkRkWEVNd0pBcUptNmZaNXE1cWkrY29lTy8rdUpNdkYzTG9kbWRrbTBURGMyV09JN0FsUk45bDBiUUtXSFh6aGNzTVdZLy8wZjk4S2cxOHhqd0MvNHFTeDA5UktHSDA5bVdoZG1rcXhPQUNtbzZRNnJhVjhiaFR4SFVmMmtLYnVhdmlnRFV5cVJ2dHNJaDhoUVFabUZjRjdPSVpUdFAvYnhSVE15UjZkUU0vTHpwbDduRDdqYXBhUkpIc2JlZGxJdlZFZXZhd2lyV0o3aHNPNXErNGpQMVAzSk9tRG5SUnpHL256d1FjWEFwV3JDQjhXbmtoU09lWGFISjdta3lLNUJVQUNVUkJPNXpzeUNrdFdhTnh1dVZWeVR4L1pTVTRYZWtEUURyWUtETDNvZjBkTmUreGtzcno2Qmx6cXFESzNYT1FIbGkxWWZwRWIybS8reW44S3doc0NQMHc4bVJFUEszN2pZc2huOXFHMDhIdGJSb2RUa3NiSXlnZ1pHWkpVOU1FVWhQN0VHNFdkc0NOVXhVbitENTJOTTlKVy9tbmRHbGh5ZzY0VE9IRVZVT08vRTZ3WDQ0Y0E0L2YxTk9XRy96QzNGeG5VeUJlVHA0VzBkVCtSeTNQQXpFWjlHTEhLWVB2ZWlpS05ueUUzaHlRNWFGc2orMENnS042Zk82czJKYysyZmJrUmZXRk5tTEF1eGJXdzl6SnVvNUhaVUZzRVZBT0N3emhyeDFDdWlsSmp1Um8xVWVFWnpxNUw5bzVjNFlqVFJMS254VXAvMmdqTmxqL0k5TzIvU09HUmZGamtRaWwyeis5b0ZINWJOQmVvRCtQWDFoS083cnJ4YzA2SExWa3NoQnpnR1RIcFQrSnE0N2cxUG9BL1RENnRNZm1UVEd0SStFV0VDbzZNT0RUcjA2aGpIdFFPUGNtRVMyWlFZei9iWi9HbUkwTDI5WnQvblE1MkNmYVNmNjlBZDdmZFpnMlhxMmt1Z3ZkOHRVNHAyM2JUSnV4QmM1TUFBZU0veHNGRjlLNkYxQT0949:T558,R0tuRGJKb3E2cnpLelM5L1Y0VGJaWVh1Nkc1U2FnRlRzbExHUGtFdER1QktJQ3kzNGN0MXJLZXo0NlcrdVJUNjRRMXlTNENDdFFuTkM3RVhIOFladUx0bGJ1MGNEaURsZEdIVFQvU25iS21pdktUTjRySHk2TWdZMVVTdThaaGtxa3BmRk84UWsxblZUbVpOekowanY2RGhCSWFoY0lYbXRYOHZxNndPUUVlMkVDclkzb3NBZ2NPaUlhWmdNY25nSzhZSUo4OUoxK1AvaHYrdFhRR3hhZGJlUkh0bG84UTFxSnp0KzRyOWtWZ0o3TTVVMTBxckt2aUV4anBYS2RzdURkUXNDZmFydWhTRlUvS3c5NE5nZjI0WGoyVWgwQlZXUEVtUzRMVmt2bHhhT042aUw3YmtYQ00wcmZMbXBtamZoTTRhSmV4UHVmY2JxNjBHcUFiSUkxZWIvZEhRVFJXa013YUFLY1VDS0s0andkQTFManQyVFJycUF5UC9CTzBaczRNM01RcFpKRnpkUDVaNlk4dTdadXJOd2htNFROVnFWcFErT1dlNHlSTGQ1cEIveElPVjl1VXQzRkRWSFpWMHorY25RREltanpLcWlGUjY5VDNzWEV5THRCZTB6TkY2ZFA1WFovMExkOWFKUHB4b2h4U2NLeGhTWFAwNmVNSmZYTHNCZGY0ZlZycmhxMmdqeVJ4SWJxNnFTRkRsdHdUOUNnOTlvdXZmaDAwRkxJS1U3L2hyYXZpOUEzNXF3ZmxXYTMwQ0pleHIzbldxc3hiVmdsbGUyb0JnNDdXa1BZNE16OGRaQ3piUS9McDROWlhkcTdKQko4Rkc1N29LVGlKalJCS2QvZUJlOVhUQmxDQW9BcXhnOTJlUUJnVXRKZkIxQkZGLzJzSjJvRUlUdEN5RjRtZGQydzVQUkZSbkRXaDVjLzJGMmViQU1vL0t5enJVNlg0SE1GUnJjd2JVdUNsVjc1L21CeXNUVlcxb2xpTStjVmdlS1BNZ05tUmp5WW5LVWVLNVk3b1VnczVBRGRXeG95ZVVHZUh6R0JhMnFaMWY4dlFNdHV5TjBlU0ExYisvakh2ZW8rb29HTC96VWpUOEM5UGlUVGpSak1oTDF4Q3h5ZUg0d3NOenVuWDZ3S1FuK2NkOTI0cmgwQ0dLTzFGeDExd2xwZDZlYUIrOW4zQ1FoMUNZN0Uwa0hXNDFHc1dZRk82bzJ4M2VKem56QlIrTDFlMmFDOHBSRG1uVGFteXhKZDBWUkcxV2JWLy85ZE5jbXNkTVQydWpYaDRUVC8zZXFieDN2cmdsbURXZjNZMG1BV1RWdXdsSEZPN2s1NWE5ckg1NVlhMFIvSG1rVFd5Yg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"67180b1aaff61a299c0507cc","environment_id":160,"environment_description":"Windows 10 64 bit","size":66560,"type":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","type_short":["peexe","assembly","executable"],"type_short_id":".NET exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"decoded_file.exe","md5":"88e8cee71f454bc1fa6b3a7741a3bd7d","sha1":"38a28b1c29b916fa296e3d48e03ddf33a7fbead0","sha256":"1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798","sha512":"ea0145a49c8dbba05ca84b98a2711cfaf876a0dfbc1c166611b3bacc3c6f0959ebd29cfcd59179079cb518ef793eaddd0ccd1f53a839d97f7b436c1f19a0fbc8","ssdeep":"1536:o206lH9kGYrsVqfhuD2a/d97IURE8vU6aoM9EKKbE4I1xgJK8riTRxx:o206lH9kSE8vU6aoM9EvbEpxgtIbx","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","entrypoint":"0x41162e","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["32BIT_MACHINE","EXECUTABLE_IMAGE"],"dll_characteristics":["NO_SEH","TERMINAL_SERVER_AWARE","DYNAMIC_BASE","NX_COMPAT","HIGH_ENTROPY_VA"],"major_os_version":"4","minor_os_version":"0","av_detect":57,"vx_family":null,"url_analysis":false,"analysis_start_time":"2024-10-22T20:29:14+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["madmrx.duckdns.org"],"compromised_hosts":[],"hosts":["23.26.108.213","23.26.108.213","23.26.108.213"],"total_network_connections":3,"total_processes":1,"total_signatures":159,"extracted_files":[{"name":"decoded_file.exe","file_path":null,"file_size":66560,"md5":"88e8cee71f454bc1fa6b3a7741a3bd7d","sha1":"38a28b1c29b916fa296e3d48e03ddf33a7fbead0","sha256":"1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798","sha512":"ea0145a49c8dbba05ca84b98a2711cfaf876a0dfbc1c166611b3bacc3c6f0959ebd29cfcd59179079cb518ef793eaddd0ccd1f53a839d97f7b436c1f19a0fbc8","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"decoded_file.exe (PID: 1868)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Gen:Trojan.Mardom.MN","av_matched":12,"av_total":21,"file_available_to_download":true,"download_link":"/bff/report/67180b1aaff61a299c0507cc/download/dropped-file?key=4b2c32f97c3c4736f24eecc7d4f790d8c85845e42cbefa430fcc3e11f0d9a356652b9343c6427d9caa527d454669ff424cacb57c8d21a7d2aed6390b5953b214","submit_link":"/bff/report/67180b1aaff61a299c0507cc/submit/dropped-file?key=4b2c32f97c3c4736f24eecc7d4f790d8c85845e42cbefa430fcc3e11f0d9a356652b9343c6427d9caa527d454669ff424cacb57c8d21a7d2aed6390b5953b214","has_overview":true,"extended_details":{"filename":"decoded_file.exe","size":66560,"description":null,"architecture":"32 Bit","ssdeep":"1536:o206lH9kGYrsVqfhuD2a/d97IURE8vU6aoM9EKKbE4I1xgJK8riTRxx:o206lH9kSE8vU6aoM9EvbEpxgtIbx","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"23d9fad78ea0073d415cd33ece58710072d068985add9667e6f12d39ae784049","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":null},{"id":"Assembly Version","value":"1.0.0.0"},{"id":"InternalName","value":"Stub.exe"},{"id":"FileVersion","value":"1.0.0.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":null},{"id":"ProductName","value":null},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"FileDescription","value":null},{"id":"OriginalFilename","value":"Stub.exe"}],"file_sections":[{"name":".text","entropy":5.58641638946,"virtual_address":"0x2000","virtual_size":"0xf634","raw_size":"0xf800","md5":"6ae47d4dda227b9370ff4723e8f11229"},{"name":".rsrc","entropy":4.88486615034,"virtual_address":"0x12000","virtual_size":"0x7ff","raw_size":"0x800","md5":"33cdbc5c50f34a35b4f0e61582ac7f11"},{"name":".reloc","entropy":0.101910425663,"virtual_address":"0x14000","virtual_size":"0xc","raw_size":"0x200","md5":"76fd6156d87063ecc4cc218c73434e23"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"Log.tmp","file_path":"%TEMP%\\Log.tmp","file_size":58,"md5":"ad6b3db8ffe05822354ecdc21d73d4cd","sha1":"aaa5218f682abb84fe155744dcfa9321e005af0c","sha256":"28451a5f11aa8ff490df32b5a6c845e053c7865e39f660477fee4e4e1dffef32","sha512":"bae272e601d1f1ff9053608b7ac467c1762b3488b65dff1cb1325844560cbd044024b6c74f51e0fb233b4fcee5600e58b9190c70fff7193129b6c155f630ac7f","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"decoded_file.exe (PID: 1868)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67180b1aaff61a299c0507cc/download/dropped-file?key=304593e9e50a7bdf377b13971003d29a3ee87a27112fc2a46adf315e429c472f115b5ac11563bb83a921f3009594a70544cbf7bb37907424190c7fb8edd17a7fe3","submit_link":"/bff/report/67180b1aaff61a299c0507cc/submit/dropped-file?key=304593e9e50a7bdf377b13971003d29a3ee87a27112fc2a46adf315e429c472f115b5ac11563bb83a921f3009594a70544cbf7bb37907424190c7fb8edd17a7fe3","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00001868","parentuid":null,"name":"decoded_file.exe","normalized_path":"C:\\decoded_file.exe","command_line":null,"sha256":"1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798","av_label":"Gen:Trojan.Mardom.MN","av_matched":12,"av_total":21,"pid":"1868","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"12/21"}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to execute an application (API string)","Contains ability to execute Windows APIs","Contains ability to execute application (Dotnet)","Dotnet source code contains suspicious native API","Calls an API typically used to retrieve function addresses","Found Native API in Dotnet file"],"parent":null},{"tactic":"Execution","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Loads the .NET runtime environment","Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a reference to a WMI query string known to be used for VM detection"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to execute a WMI query","Contains ability to execute WMI queries (Dotnet)"],"parent":null},{"tactic":"Execution","technique":"Malicious File","attck_id":"T1204.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1204/002","malicious_identifiers_count":1,"malicious_identifiers":["The analysis extracted a file that was identified as malicious"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"User Execution","attck_id":"T1204","attck_id_wiki":"https://attack.mitre.org/techniques/T1204"}},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to access device drivers","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Persistence","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to access device drivers","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":11,"informative_identifiers":["Contains ability to use Cryptographic classes","Contains CRYPTO related strings","Contains ability to decrypt data using RSA (Dotnet String)","Loads the Bcrypt module DLL","Contains ability to encrypt data using RSA (Dotnet String)","Contains ability to perform symmetric encryption (Dotnet)","Matched Compiler/Packer signature (DIE)","Contains ability to perform crypto operations","Contains ability to perform CryptoStream operations (Dotnet)","Dotnet file contains encryption/decryption functions","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to decode base64 data","Contains ability to perform AES decryption (Dotnet String)","Contains ability to perform symmetric decryption (Dotnet)","Contains ability to decode string content at runtime (Dotnet)","Contains ability to load content into memory (Dotnet)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Loads the CLR Loader DLL","Dotnet code contains potential unpacker"],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Writes registry keys"],"informative_identifiers_count":1,"informative_identifiers":["Dotnet code contains ability to modify/delete registry"],"parent":null},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to evade analysis by sleeping many times"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use execution guardrails"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Drops a file that contains keystrokes (possible keylogger)"],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve information about pressed keystrokes (API string)","Contains ability to hook/unhook windows functions (API string)","Found strings related to keylogger","Contains ability to collect clipboard information (Dotnet)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":1,"malicious_identifiers":["Sets a global windows hook to intercept keystrokes"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Sets a windows hook"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Password Managers","attck_id":"T1555.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1555/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555"}},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Tries to access non-existent files (executable)","Reads files","Calls an API's typically used for searching a directory for a files","References Windows filepaths for DLLs (possible dropped files)","Touches files","Tries to access non-existent files (non-executable)"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Calls an API possibly used to retrieve a handle to the foreground window","Calls an API typically used to get active windows title","Calls an API typically used to enumerate active windows"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":14,"informative_identifiers":["References to WMI query strings used for information discovery","Contains ability to retrieve a module handle (API string)","Contains ability to retrieve the host's architecture (API string)","Calls an API typically used to retrieve information about the current system","Calls an API typically used to retrieve computer name","Contains ability to read software policies","Contains ability to gather system information (Dotnet)","Calls an API typically used to get product type","Reads information about supported languages","Reads the cryptographic machine GUID","Queries volume information","Calls an API typically used to get system version information","Reads the active computer name","Contains ability to gather system environment details"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains registry location strings","Opens registry keys","Dotnet code contains ability to query registry","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Possibly checks for the presence of an Antivirus engine"],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Queries basic information of the specified process","Calls an API typically used for taking snapshot of the specified processes","Contains ability to gather process details (Dotnet)"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to retrieve user privileges (API string)","Calls an API typically used to retrieve user name","Contains ability to retrieve usernames and/or user information (API string)","Contains ability to retrieve user privileges","Contains ability to retrieve current user details (Dotnet)"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve system language (API string)","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to evade analysis by sleeping many times"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Writes files in a temp directory","May execute SQL queries"],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a potential E-Mail address in binary/memory"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Drops a file that contains keystrokes (possible keylogger)"],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve information about pressed keystrokes (API string)","Contains ability to hook/unhook windows functions (API string)","Found strings related to keylogger","Contains ability to collect clipboard information (Dotnet)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":1,"malicious_identifiers":["Sets a global windows hook to intercept keystrokes"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Sets a windows hook"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Collection","technique":"Archive via Library","attck_id":"T1560.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to decompress content at runtime"],"parent":{"technique":"Archive Collected Data","attck_id":"T1560","attck_id_wiki":"https://attack.mitre.org/techniques/T1560"}},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned process connects to a network"],"informative_identifiers_count":5,"informative_identifiers":["Found potential URL in binary/memory","Found potential IP address in binary/memory","Contains ability to communicate with network (API string)","Contains ability to communicates via socket (possible C&C communication)","Contacts server"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform encryption/decryption using RSA algorithm","Contains ability to perform asymmetric crypto operations"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate via sockets (Dotnet)"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Drops executable files"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to download files with network (Dotnet)","Dropped files","Drops temp files"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Making HTTPS connections using secure TLS/SSL version"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":1,"malicious_identifiers":["Uses network protocols on unusual ports"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to open a port and listen for incoming connection"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contacts random domain names"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to provide interface for network protocols (Dotnet)","Contains ability to communicate with network (Dotnet)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Web Service","attck_id":"T1102","attck_id_wiki":"https://attack.mitre.org/techniques/T1102","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contact Dynamic dns (possible C&C communication)"],"parent":null},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform symmetric crypto operations"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform encryption (API string)","Contains reference to cryptographic keys"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-116","type":0,"relevance":1,"name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"decoded_file.exe\"","description_v2":["Observed function \"System.IO.Compression.GZipStream\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"System.IO.Compression.GZipStream\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1560.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-107","type":0,"relevance":1,"name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"decoded_file.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReadInt32\" in \"decoded_file.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"decoded_file.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"decoded_file.exe\"","Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReadInt32\" in \"decoded_file.exe\"","Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"decoded_file.exe\"","Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReadInt32\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$25","description_v2":["Found reference to \"HMACSHA256\" (Indicator: \"HMAC\"; File: \"decoded_file.exe\")","Found reference to \"HMACSHA256\" (Indicator: \"HMACSHA256\"; File: \"decoded_file.exe\")","Found reference to \"SHA256Managed\" (Indicator: \"SHA256Managed\"; File: \"decoded_file.exe\")","Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")","Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; File: \"decoded_file.exe\")","Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")","Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"decoded_file.exe\")","Found reference to \"AsymmetricAlgorithm\" (Indicator: \"AsymmetricAlgorithm\"; File: \"decoded_file.exe\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"decoded_file.exe\")","Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; File: \"decoded_file.exe\")","Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"decoded_file.exe\")","Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"decoded_file.exe\")","Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"decoded_file.exe\")","Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"DeriveBytes\"; File: \"decoded_file.exe\")","Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"Rfc2898DeriveBytes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"Aes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"AesCryptoServiceProvider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"AsymmetricAlgorithm\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"CryptoConfig\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"CryptographicException\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"DeriveBytes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"HMAC\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"HMACSHA256\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"Rfc2898DeriveBytes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"SHA256Managed\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"SymmetricAlgorithm\"; File: \"decoded_file.exe\")","Found reference to \"HMACSHA256\" (Indicator: \"HMAC\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"HMACSHA256\" (Indicator: \"HMACSHA256\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"SHA256Managed\" (Indicator: \"SHA256Managed\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"AsymmetricAlgorithm\" (Indicator: \"AsymmetricAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"HMACSHA256\" (Indicator: \"HMAC\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMACSHA256\" (Indicator: \"HMACSHA256\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA256Managed\" (Indicator: \"SHA256Managed\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AsymmetricAlgorithm\" (Indicator: \"AsymmetricAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"DeriveBytes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"Rfc2898DeriveBytes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"Aes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"AesCryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"AsymmetricAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CryptoConfig\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CryptographicException\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CryptoStream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"DeriveBytes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"HMAC\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"HMACSHA256\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"Rfc2898DeriveBytes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"SHA256Managed\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"SymmetricAlgorithm\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMACSHA256\" (Indicator: \"HMAC\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMACSHA256\" (Indicator: \"HMACSHA256\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA256Managed\" (Indicator: \"SHA256Managed\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoConfig\" (Indicator: \"CryptoConfig\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"AsymmetricAlgorithm\" (Indicator: \"AsymmetricAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-115","type":0,"relevance":1,"name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"decoded_file.exe\"","description_v2":["Observed function \"System.Reflection.Load\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"System.Reflection.Load\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"static-134","type":0,"relevance":1,"name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"decoded_file.exe\")","description_v2":["Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"decoded_file.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"decoded_file.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-106","type":2,"relevance":1,"name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")","Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-106","type":0,"relevance":1,"name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"decoded_file.exe\"\n Observed function \"ToBase64String\" in \"decoded_file.exe\"","description_v2":["Observed function \"FromBase64String\" in \"decoded_file.exe\"","Observed function \"ToBase64String\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"FromBase64String\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"ToBase64String\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-357","type":2,"relevance":1,"name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe","description_v2":["Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-358","type":2,"relevance":1,"name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateEncryptor\" in Source: decoded_file.exe","description_v2":["Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateEncryptor\" in Source: decoded_file.exe"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateEncryptor\" in Source: decoded_file.exe"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-445","type":2,"relevance":1,"name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesCryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe","description_v2":["Observed string: \"System.Security.Cryptography.X509Certificates.AesCryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe"],"description_v3":[{"type":"text","value":"Observed string: \"System.Security.Cryptography.X509Certificates.AesCryptoServiceProvider.CreateDecryptor\" in Source: decoded_file.exe"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-166","type":0,"relevance":1,"name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-141","type":0,"relevance":1,"name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-118","type":0,"relevance":1,"name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"decoded_file.exe\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"decoded_file.exe\"]","description_v2":["Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"decoded_file.exe\"]","Observed namespace \"System.Security.Cryptography\" in [Source: \"decoded_file.exe\"]"],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"decoded_file.exe\"]"},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Security.Cryptography\" in [Source: \"decoded_file.exe\"]"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-108","type":2,"relevance":1,"name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")","description_v2":["Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-352","type":2,"relevance":1,"name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")\n file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")","Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-140","type":0,"relevance":1,"name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-168","type":0,"relevance":1,"name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-165","type":0,"relevance":1,"name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$26","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to decrypt data using RSA (Dotnet String)","Matched sigs: Contains ability to perform encryption (API string)","Matched sigs: Contains ability to decode base64 data","Matched sigs: Calls an API typically used to decrypt a block of data","Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP","Matched sigs: Contains ability to decrypt/decode data","Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm","Matched sigs: Contains ability to encrypt data using RSA (Dotnet String)","Matched sigs: Contains ability to perform AES decryption (Dotnet String)","Matched sigs: Contains ability to perform asymmetric crypto operations","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to perform symmetric encryption (Dotnet)","Matched sigs: Contains ability to perform symmetric decryption (Dotnet)","Matched sigs: Calls an API typically used to decrypt data","Matched sigs: Tries to steal crypto wallet extension (string)","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Calls an API typically to import cryptographic keys into a CSP","Matched sigs: Contains ability to decode string content at runtime (Dotnet)","Matched sigs: Contains ability to perform crypto operations","Matched sigs: Contains ability to perform CryptoStream operations (Dotnet)","Matched sigs: Contains ability to perform symmetric crypto operations","Matched sigs: Dotnet file contains encryption/decryption functions"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decrypt/decode data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform AES decryption (Dotnet String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform asymmetric crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric encryption (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric decryption (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Tries to steal crypto wallet extension (string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically to import cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode string content at runtime (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform symmetric crypto operations"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dotnet file contains encryption/decryption functions"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-659","type":2,"relevance":1,"name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862028918\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862361174\")","description_v2":["Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862028918\")","Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862361174\")"],"description_v3":[{"type":"text","value":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862028918\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001868-00000C29-862361174\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")\n file/memory contains long string with (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")","Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"decoded_file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-152","type":6,"relevance":3,"name":"Calls an API typically used to enumerate active windows","description":"\"decoded_file.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"decoded_file.exe\" called \"GetWindowTextW\" (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"GetWindowTextW\" (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetWindowTextW\" (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"decoded_file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$27","description_v2":["\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000078dcaf001cdcaf00226e03770000ed02000000002d6e0377a69cb68e2d000000ecb7f573a0dcaf0000007e003095cb02687ac6020100000080000000e0dbaf0000007e0064dcaf0070c80477423110f9feffffff2d000000d0cc04742700000034dcaf00856a05771c230a7774dcaf00f85f057708000000bb690477b2690477ce9cb68e2d000000ecb7f57327000000d0cc047448dcaf002d000000d0cc04742700000078dcaf00856a05771c230a77c0dcaf007e8a0374ee8c0374738a03745dc3d3162d000000ecb7f57327000000d0cc0474e427ed027827ed025dc3d31688dcaf00fc52417474ddaf00e0840374a5ee4362feffffff738a0374 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000646f187d646f00000000d0a9817600007a7690117b76d8f1cb02a8d4c6020011cf02e0ecd307feffffff88efd307506ac477b4228ab0feffffffa0edd307eaa9c077d8f1cb02000000000011cf02a11400000a000b00b297646f5c76646f6876646f0011cf02b0bfcf02140000000000000000000000d8f1cb02c8edd307cc2dc5770011cf02000000000c11cf0200000000f8005d6f00000000cc0d24385ce8c3776840c2772c0400000011cf02000000007740c277000000000100000004f2cb02180000000000000038eed3074008000000000000000000000011cf0200005d6ffefffffffcf1cb022c04000000000000000000002345c27728eed307 (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000078dcaf001cdcaf00226e03770000ed02000000002d6e0377a69cb68e2d000000ecb7f573a0dcaf0000007e003095cb02687ac6020100000080000000e0dbaf0000007e0064dcaf0070c80477423110f9feffffff2d000000d0cc04742700000034dcaf00856a05771c230a7774dcaf00f85f057708000000bb690477b2690477ce9cb68e2d000000ecb7f57327000000d0cc047448dcaf002d000000d0cc04742700000078dcaf00856a05771c230a77c0dcaf007e8a0374ee8c0374738a03745dc3d3162d000000ecb7f57327000000d0cc0474e427ed027827ed025dc3d31688dcaf00fc52417474ddaf00e0840374a5ee4362feffffff738a0374 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000646f187d646f00000000d0a9817600007a7690117b76d8f1cb02a8d4c6020011cf02e0ecd307feffffff88efd307506ac477b4228ab0feffffffa0edd307eaa9c077d8f1cb02000000000011cf02a11400000a000b00b297646f5c76646f6876646f0011cf02b0bfcf02140000000000000000000000d8f1cb02c8edd307cc2dc5770011cf02000000000c11cf0200000000f8005d6f00000000cc0d24385ce8c3776840c2772c0400000011cf02000000007740c277000000000100000004f2cb02180000000000000038eed3074008000000000000000000000011cf0200005d6ffefffffffcf1cb022c04000000000000000000002345c27728eed307 (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-114","type":0,"relevance":1,"name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Management.ManagementObjectSearcher\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-433","type":2,"relevance":1,"name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")\n Found string \"Select * from AntivirusProduct\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")","description_v2":["Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")","Found string \"Select * from AntivirusProduct\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")"],"description_v3":[{"type":"text","value":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Select * from AntivirusProduct\" (Indicator: \"select * from \"; File: \"decoded_file.exe\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-119","type":0,"relevance":1,"name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"decoded_file.exe\"\n Observed function \"GetEnvironmentVariable\" in \"decoded_file.exe\"","description_v2":["Observed function \"ExpandEnvironmentVariables\" in \"decoded_file.exe\"","Observed function \"GetEnvironmentVariable\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"ExpandEnvironmentVariables\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"GetEnvironmentVariable\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-120","type":0,"relevance":1,"name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"decoded_file.exe\"\n Observed function \"get_UserName\" in \"decoded_file.exe\"\n Observed function \"get_MachineName\" in \"decoded_file.exe\"\n Observed function \"get_OSVersion\" in \"decoded_file.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"decoded_file.exe\"","description_v2":["Observed function \"get_SystemDirectory\" in \"decoded_file.exe\"","Observed function \"get_UserName\" in \"decoded_file.exe\"","Observed function \"get_MachineName\" in \"decoded_file.exe\"","Observed function \"get_OSVersion\" in \"decoded_file.exe\"","Observed function \"get_Is64BitOperatingSystem\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"get_SystemDirectory\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"get_UserName\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"get_MachineName\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"get_OSVersion\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"get_Is64BitOperatingSystem\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-152","type":0,"relevance":1,"name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"decoded_file.exe\"","description_v2":["Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"decoded_file.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"decoded_file.exe\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \",109,,GetWindowTextW,user32.dll,\"00:31:16.484\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","description_v2":["Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"decoded_file.exe\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"decoded_file.exe\")","Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \",109,,GetWindowTextW,user32.dll,\"00:31:16.484\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \",109,,GetWindowTextW,user32.dll,\"00:31:16.484\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"decoded_file.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"decoded_file.exe\")","Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00001868-00000C15-861815389\n \"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00001868-00000C15-862391804\n \"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\" at 00000000-00001868-00000C15-862666384","description_v2":["\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00001868-00000C15-861815389","\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00001868-00000C15-862391804","\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\" at 00000000-00001868-00000C15-862666384"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00001868-00000C15-861815389"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00001868-00000C15-862391804"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\" at 00000000-00001868-00000C15-862666384"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain\" (SID: 2022918, Rev: 5, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain\" (SID: 2022918, Rev: 5, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain\" (SID: 2022918, Rev: 5, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$28","description_v2":["\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter advapi32 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter crypt32 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00001868)","\"decoded_file.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter advapi32 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter crypt32 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$29","description_v2":["\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptGetProvParam (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptContextAddRef (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDuplicateKey (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptSetKeyParam (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecrypt (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptQueryObject (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptFindOIDInfo (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptFindOIDInfoW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObject (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObjectW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateMutex (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadExecutionState (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSASocket (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSASocketW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAEventSelect (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetAddrInfoW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetLastInputInfo (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetModuleHandle (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowsHookEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowsHookExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAConnect (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterWindowMessage (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterWindowMessageW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemMetrics (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ProcessIdToSessionId (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmCreateContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmDestroyContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmNotifyIME (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmAssociateContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmReleaseContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetContext (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetCompositionStringA (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCompositionStringA (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetCompositionStringW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCompositionStringW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCandidateWindow (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DefWindowProcW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetStockObject (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterClass (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterClassW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateWindowEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateWindowExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowLong (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowLongW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowLong (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowLongW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallWindowProc (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallWindowProcW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetClientRect (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowRect (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetParent (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OleInitialize (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoRegisterMessageFilter (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter PeekMessage (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter PeekMessageW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WaitMessage (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyState (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyboardState (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter MapVirtualKey (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter MapVirtualKeyA (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetForegroundWindow (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyboardLayout (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ToUnicodeEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumProcesses (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumProcessesW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindow (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter IsWindowVisible (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter IsWindowVisibleW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLength (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLengthW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowText (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextW (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallNextHookEx (UID: 00000000-00001868)","\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallNextHookExW (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptGetProvParam (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptContextAddRef (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDuplicateKey (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptSetKeyParam (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecrypt (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptQueryObject (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptFindOIDInfo (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptFindOIDInfoW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObject (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObjectW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateMutex (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetThreadExecutionState (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSASocket (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSASocketW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAEventSelect (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetAddrInfoW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetLastInputInfo (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetModuleHandle (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowsHookEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowsHookExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WSAConnect (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterWindowMessage (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterWindowMessageW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetSystemMetrics (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ProcessIdToSessionId (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmCreateContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmDestroyContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmNotifyIME (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmAssociateContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmReleaseContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetContext (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetCompositionStringA (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCompositionStringA (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmGetCompositionStringW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCompositionStringW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ImmSetCandidateWindow (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter DefWindowProcW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetStockObject (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterClass (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegisterClassW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateWindowEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CreateWindowExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowLong (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetWindowLongW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowLong (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowLongW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallWindowProc (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallWindowProcW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetClientRect (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowRect (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetParent (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter OleInitialize (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CoRegisterMessageFilter (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter PeekMessage (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter PeekMessageW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WaitMessage (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyState (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyboardState (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter MapVirtualKey (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter MapVirtualKeyA (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetForegroundWindow (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetKeyboardLayout (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter ToUnicodeEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumProcesses (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumProcessesW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindow (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter IsWindowVisible (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter IsWindowVisibleW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLength (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLengthW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowText (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter GetWindowTextW (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallNextHookEx (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"GetProcAddress\" with a parameter CallNextHookExW (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"23.26.108.213:8808\"\n \"23.26.108.213:7707\"\n \"23.26.108.213:6606\"","description_v2":["\"23.26.108.213:8808\"","\"23.26.108.213:7707\"","\"23.26.108.213:6606\""],"description_v3":[{"type":"text","value":"\"23.26.108.213:8808\""},{"type":"linebreak"},{"type":"text","value":"\"23.26.108.213:7707\""},{"type":"linebreak"},{"type":"text","value":"\"23.26.108.213:6606\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")\n \"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")","description_v2":["\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")","\"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")"],"description_v3":[{"type":"text","value":"\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")"},{"type":"linebreak"},{"type":"text","value":"\"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-99","type":0,"relevance":1,"name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\"","description_v2":["Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$2a","description_v2":["Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetProcessById\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetEnvironmentVariable\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetTempFileName\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetKeyboardState\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"SetThreadExecutionState\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetKeyState\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetTempPath\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"RtlSetProcessIsCritical\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"Sleep\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetKeyboardLayout\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetWindowText\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"ToUnicodeEx\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"UnhookWindowsHookEx\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"SetWindowsHookEx\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"CallNextHookEx\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"MapVirtualKey\"; File: \"decoded_file.exe\")","Found reference to API (Indicator: \"SystemParametersInfoA\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessById\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempFileName\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetThreadExecutionState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPath\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlSetProcessIsCritical\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"CheckRemoteDebuggerPresent\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"ToUnicodeEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhookWindowsHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowsHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"CallNextHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessById\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariable\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileName\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadExecutionState\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyState\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPath\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlSetProcessIsCritical\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastInputInfo\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayout\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowText\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ToUnicodeEx\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhookWindowsHookEx\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowsHookEx\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CallNextHookEx\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapVirtualKey\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoA\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessById\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileName\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadExecutionState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPath\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlSetProcessIsCritical\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckRemoteDebuggerPresent\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowText\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ToUnicodeEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhookWindowsHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowsHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CallNextHookEx\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"decoded_file.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"decoded_file.exe\")","Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-108","type":0,"relevance":1,"name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"decoded_file.exe\"","description_v2":["Observed function \"set_UseShellExecute\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"set_UseShellExecute\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"decoded_file.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"decoded_file.exe\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$2b","description_v2":["\"\\BraveSoftware\\Brave-Browser\" in Source: decoded_file.exe","\"\\Opera Software\\Opera GX Stable\\Local Extension Settings\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: decoded_file.exe","\"\\BraveSoftware\\Brave-Browser\\User Data\" in Source: decoded_file.exe","\"Software\\\" in Source: decoded_file.exe","\"\\\\BraveSoftware\\\\Brave-Browser\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ","\"\\\\Opera Software\\\\Opera Stable\\\\Local Extension Settings\\\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ","\"\\\\Opera Software\\\\Opera GX Stable\\\\Local Extension Settings\\\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ","\"\\\\Opera Software\\\\Opera GX Stable\\\\Local Extension Settings\\\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ","\"\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\" in Source: 6000031-cctor","\"Software\\\\\" in Source: 6000061-cctor","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 024\" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp","\"BraveSoftware\\Brave-Browser\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp","\"Opera Software\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp","\"Opera Software\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp","\"Opera Software\\Opera GX Stable\\Local Extension Settings\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp","\"BraveSoftware\\Brave-Browser\\User Data\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"\\BraveSoftware\\Brave-Browser\" in Source: decoded_file.exe"},{"type":"linebreak"},{"type":"text","value":"\"\\Opera Software\\Opera GX Stable\\Local Extension Settings\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: decoded_file.exe"},{"type":"linebreak"},{"type":"text","value":"\"\\BraveSoftware\\Brave-Browser\\User Data\" in Source: decoded_file.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\\" in Source: decoded_file.exe"},{"type":"linebreak"},{"type":"text","value":"\"\\\\BraveSoftware\\\\Brave-Browser\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ"},{"type":"linebreak"},{"type":"text","value":"\"\\\\Opera Software\\\\Opera Stable\\\\Local Extension Settings\\\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ"},{"type":"linebreak"},{"type":"text","value":"\"\\\\Opera Software\\\\Opera GX Stable\\\\Local Extension Settings\\\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ"},{"type":"linebreak"},{"type":"text","value":"\"\\\\Opera Software\\\\Opera GX Stable\\\\Local Extension Settings\\\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: 600002f-PKZJZDnPsq~YpQaVeaHCDDvJ"},{"type":"linebreak"},{"type":"text","value":"\"\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\" in Source: 6000031-cctor"},{"type":"linebreak"},{"type":"text","value":"\"Software\\\\\" in Source: 6000061-cctor"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 024\" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" in Source: 00000000-00001868.00000000.117202.02C60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"BraveSoftware\\Brave-Browser\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Opera Software\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Opera Software\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Opera Software\\Opera GX Stable\\Local Extension Settings\\chrome-extension://djclckkglechooblngghdinmeemkbgci\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"BraveSoftware\\Brave-Browser\\User Data\" in Source: 00000000-00001868.00000002.121044.006C2000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"Local\\SM0:1868:168:WilStaging_02\"\n \"SM0:1868:168:WilStaging_02\"\n \"SM0:1868:64:WilError_01\"\n \"AsyncMutex_8723873\"","description_v2":["\"Local\\SM0:1868:168:WilStaging_02\"","\"SM0:1868:168:WilStaging_02\"","\"SM0:1868:64:WilError_01\"","\"AsyncMutex_8723873\""],"description_v3":[{"type":"text","value":"\"Local\\SM0:1868:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:1868:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:1868:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"AsyncMutex_8723873\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-139","type":0,"relevance":1,"name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"decoded_file.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"decoded_file.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"decoded_file.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"decoded_file.exe\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"decoded_file.exe\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"decoded_file.exe\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-138","type":0,"relevance":1,"name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"decoded_file.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"decoded_file.exe\"","Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-126","type":0,"relevance":1,"name":"Dotnet source code contains suspicious native API","description":"Observed API \"MapVirtualKey\" in \"decoded_file.exe\"","description_v2":["Observed API \"MapVirtualKey\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed API \"MapVirtualKey\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"$2c","description_v2":["\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll\" - [base:0; Status:ffffffffc0000135]","\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:ffffffffc0000135]"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:ffffffffc0000135]"}],"origin":"API Call","attck_id":"T1574.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"decoded_file.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","description_v2":["\"decoded_file.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-101","type":0,"relevance":1,"name":"Found Native API in Dotnet file","description":"$2d","description_v2":["Observed unmanaged function \"SetWindowsHookEx\" in \"decoded_file.exe\"","Observed unmanaged function \"UnhookWindowsHookEx\" in \"decoded_file.exe\"","Observed unmanaged function \"CallNextHookEx\" in \"decoded_file.exe\"","Observed unmanaged function \"GetModuleHandle\" in \"decoded_file.exe\"","Observed unmanaged function \"GetForegroundWindow\" in \"decoded_file.exe\"","Observed unmanaged function \"GetWindowThreadProcessId\" in \"decoded_file.exe\"","Observed unmanaged function \"GetKeyState\" in \"decoded_file.exe\"","Observed unmanaged function \"GetKeyboardState\" in \"decoded_file.exe\"","Observed unmanaged function \"GetKeyboardLayout\" in \"decoded_file.exe\"","Observed unmanaged function \"ToUnicodeEx\" in \"decoded_file.exe\"","Observed unmanaged function \"MapVirtualKey\" in \"decoded_file.exe\"","Observed unmanaged function \"GetLastInputInfo\" in \"decoded_file.exe\"","Observed unmanaged function \"GetWindowText\" in \"decoded_file.exe\"","Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"decoded_file.exe\"","Observed unmanaged function \"SetThreadExecutionState\" in \"decoded_file.exe\"","Observed unmanaged function \"RtlSetProcessIsCritical\" in \"decoded_file.exe\"","Observed unmanaged function \"SystemParametersInfoA\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed unmanaged function \"SetWindowsHookEx\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"UnhookWindowsHookEx\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"CallNextHookEx\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetModuleHandle\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetForegroundWindow\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowThreadProcessId\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetKeyState\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetKeyboardState\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetKeyboardLayout\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"ToUnicodeEx\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"MapVirtualKey\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetLastInputInfo\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"GetWindowText\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SetThreadExecutionState\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"RtlSetProcessIsCritical\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed unmanaged function \"SystemParametersInfoA\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$2e","description_v2":["\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 765c0000","\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 765c0000","\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 765c0000","\"decoded_file.exe\" loaded module \"KERNEL32\" at base 75bc0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 727e0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM\\2C3C912EA8F058F9D04C4650128FEB3F\\SYSTEM.NI.DLL\" at base 71d00000","\"decoded_file.exe\" loaded module \"ADVAPI32.DLL\" at base 764f0000","\"decoded_file.exe\" loaded module \"SHELL32.DLL\" at base 73f30000","\"decoded_file.exe\" loaded module \"KERNEL32.DLL\" at base 75bc0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_32\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\BCRYPT.DLL\" at base 0","\"decoded_file.exe\" loaded module \"BCRYPT.DLL\" at base 732d0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 71cd0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 75a40000","\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.CORE\\31FAE3290FAD30C31C98651462D22724\\SYSTEM.CORE.NI.DLL\" at base 714b0000","\"decoded_file.exe\" loaded module \"ADVAPI32\" at base 764f0000","\"decoded_file.exe\" loaded module \"OLE32.DLL\" at base 75aa0000","\"decoded_file.exe\" loaded module \"SSPICLI.DLL\" at base 75930000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0","\"decoded_file.exe\" loaded module \"CRYPT32.DLL\" at base 76230000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\CRYPT32.DLL\" at base 0","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_32\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32\" at base 0","\"decoded_file.exe\" loaded module \"CRYPT32\" at base 76230000","\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.CONFIGURATION\\96F7EDB07B12303F0EC2595C7F3778C7\\SYSTEM.CONFIGURATION.NI.DLL\" at base 713a0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\VERSION.DLL\" at base 0","\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.XML\\15AF16D373CF0528CB74FC73D365FDBF\\SYSTEM.XML.NI.DLL\" at base 6f660000","\"decoded_file.exe\" loaded module \"VERSION.DLL\" at base 75650000","\"decoded_file.exe\" loaded module \"NTDLL.DLL\" at base 77bd0000","\"decoded_file.exe\" loaded module \"USER32.DLL\" at base 767a0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\NTDLL.DLL\" at base 0","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\WS2_32.DLL\" at base 0","\"decoded_file.exe\" loaded module \"WS2_32.DLL\" at base 75fd0000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 73200000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 71390000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 71340000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 753e0000","\"decoded_file.exe\" loaded module \"IMM32.DLL\" at base 76920000","\"decoded_file.exe\" loaded module \"COMCTL32.DLL\" at base 6f5d0000","\"decoded_file.exe\" loaded module \"GDI32.DLL\" at base 75f90000","\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\PSAPI.DLL\" at base 0","\"decoded_file.exe\" loaded module \"PSAPI.DLL\" at base 75a30000"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 765c0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 765c0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 765c0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"KERNEL32\" at base 75bc0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 727e0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM\\2C3C912EA8F058F9D04C4650128FEB3F\\SYSTEM.NI.DLL\" at base 71d00000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"ADVAPI32.DLL\" at base 764f0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"SHELL32.DLL\" at base 73f30000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"KERNEL32.DLL\" at base 75bc0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_32\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\BCRYPT.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"BCRYPT.DLL\" at base 732d0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 71cd0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 75a40000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.CORE\\31FAE3290FAD30C31C98651462D22724\\SYSTEM.CORE.NI.DLL\" at base 714b0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"ADVAPI32\" at base 764f0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"OLE32.DLL\" at base 75aa0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"SSPICLI.DLL\" at base 75930000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"CRYPT32.DLL\" at base 76230000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_32\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"CRYPT32\" at base 76230000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.CONFIGURATION\\96F7EDB07B12303F0EC2595C7F3778C7\\SYSTEM.CONFIGURATION.NI.DLL\" at base 713a0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\VERSION.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_32\\SYSTEM.XML\\15AF16D373CF0528CB74FC73D365FDBF\\SYSTEM.XML.NI.DLL\" at base 6f660000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"VERSION.DLL\" at base 75650000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"NTDLL.DLL\" at base 77bd0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"USER32.DLL\" at base 767a0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\NTDLL.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\WS2_32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"WS2_32.DLL\" at base 75fd0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 73200000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 71390000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 71340000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 753e0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"IMM32.DLL\" at base 76920000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"COMCTL32.DLL\" at base 6f5d0000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"GDI32.DLL\" at base 75f90000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\PSAPI.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"PSAPI.DLL\" at base 75a30000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"decoded_file.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FDE0000","description_v2":["\"decoded_file.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FDE0000"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FDE0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A40000\n \"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732D0000","description_v2":["\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A40000","\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732D0000"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A40000"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732D0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-7","type":10,"relevance":0,"name":"Loads the CLR Loader DLL","description":"\"decoded_file.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72930000","description_v2":["\"decoded_file.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72930000"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72930000"}],"origin":"Loaded Module","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77270000","description_v2":["\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77270000"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77270000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"decoded_file.exe\" was detected as \".NET\" and name: \"Library\"\n \"decoded_file.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"decoded_file.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"decoded_file.exe\" was detected as \".NET\" and name: \"Library\"","\"decoded_file.exe\" was detected as \"VB.NET\" and name: \"Compiler\"","\"decoded_file.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" was detected as \".NET\" and name: \"Library\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" was detected as \"VB.NET\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-605","type":2,"relevance":1,"name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")\n \"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")","description_v2":["\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")","\"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")"],"description_v3":[{"type":"text","value":"\"Select * from Win32_ComputerSystem\" (Source: decoded_file.exe, Indicator: \"select * from win32_computersystem\")"},{"type":"linebreak"},{"type":"text","value":"\"Select * from AntivirusProduct\" (Source: decoded_file.exe, Indicator: \"select * from antivirusproduct\")"}],"origin":"File/Memory","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-144","type":0,"relevance":1,"name":"PE file contains COM data directory","description":"\"decoded_file.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","description_v2":["\"decoded_file.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"decoded_file.exe\" has an executable section named \".text\"","description_v2":["\"decoded_file.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"$2f","description_v2":["$30"],"description_v3":[{"type":"text","value":"$31"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-8","type":2,"relevance":2,"name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: decoded_file.exe\n \"Avast\" (Indicator: \"avast\") in Source: decoded_file.exe","description_v2":["\"Antivirus\" (Indicator: \"antivirus\") in Source: decoded_file.exe","\"Avast\" (Indicator: \"avast\") in Source: decoded_file.exe"],"description_v3":[{"type":"text","value":"\"Antivirus\" (Indicator: \"antivirus\") in Source: decoded_file.exe"},{"type":"linebreak"},{"type":"text","value":"\"Avast\" (Indicator: \"avast\") in Source: decoded_file.exe"}],"origin":"File/Memory","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-51","type":7,"relevance":1,"name":"Queries DNS server","description":"\"madmrx.duckdns.org\"","description_v2":["\"madmrx.duckdns.org\""],"description_v3":[{"type":"text","value":"\"madmrx.duckdns.org\""}],"origin":"Network Traffic","attck_id":"T1071.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows filepaths for DLLs (possible dropped files)","description":"$32","description_v2":["Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll\" [Source: 00000000-00001868-00000C28-834498250]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" [Source: 00000000-00001868-00000C28-834817021]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll\" [Source: 00000000-00001868-00000C28-861168353]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00001868-00000C28-861421783]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00001868-00000C28-861586476]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll\" [Source: 00000000-00001868-00000C28-861859270]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" [Source: 00000000-00001868-00000C28-861915482]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll\" [Source: 00000000-00001868-00000C28-861925827]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00001868-00000C28-862045595]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll\" [Source: 00000000-00001868-00000C28-862062177]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00001868-00000C28-883625957]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll\" [Source: 00000000-00001868-00000C28-834498250]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" [Source: 00000000-00001868-00000C28-834817021]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll\" [Source: 00000000-00001868-00000C28-861168353]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00001868-00000C28-861421783]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00001868-00000C28-861586476]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll\" [Source: 00000000-00001868-00000C28-861859270]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" [Source: 00000000-00001868-00000C28-861915482]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll\" [Source: 00000000-00001868-00000C28-861925827]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00001868-00000C28-862045595]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll\" [Source: 00000000-00001868-00000C28-862062177]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00001868-00000C28-883625957]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-71","type":6,"relevance":10,"name":"Sets a windows hook","description":"\"decoded_file.exe\" sets a global windows hook with filter \"WH_KEYBOARD_LL\"","description_v2":["\"decoded_file.exe\" sets a global windows hook with filter \"WH_KEYBOARD_LL\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" sets a global windows hook with filter \"WH_KEYBOARD_LL\""}],"origin":"API Call","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"decoded_file.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"decoded_file.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-267","type":6,"relevance":1,"name":"Writes files in a temp directory","description":"\"decoded_file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Log.tmp\"","description_v2":["\"decoded_file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Log.tmp\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" writes to a file \"%TEMP%\\Log.tmp\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"decoded_file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"decoded_file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]\n \"Log.tmp\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\Log.tmp]- [targetUID: 00000000-00001868]","description_v2":["\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]","\"Log.tmp\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\Log.tmp]- [targetUID: 00000000-00001868]"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]"},{"type":"linebreak"},{"type":"text","value":"\"Log.tmp\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\Log.tmp]- [targetUID: 00000000-00001868]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-53","type":8,"relevance":1,"name":"Drops temp files","description":"\"Log.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\Log.tmp]","description_v2":["\"Log.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\Log.tmp]"],"description_v3":[{"type":"text","value":"\"Log.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\Log.tmp]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$33","description_v2":["\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\POLICIES\\MICROSOFT\\CRYPTOGRAPHY\\CONFIGURATION\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\POLICIES\\MICROSOFT\\CRYPTOGRAPHY\\CONFIGURATION\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"decoded_file.exe\" queries basic process information of the \"C:\\decoded_file.exe\" (UID: 1868)","description_v2":["\"decoded_file.exe\" queries basic process information of the \"C:\\decoded_file.exe\" (UID: 1868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" queries basic process information of the \"C:\\decoded_file.exe\" (UID: 1868)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$34","description_v2":["\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"DECODED_FILE.EXE\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"INSTALLROOT\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"CLRLOADLOGDIR\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"DECODED_FILE\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"DECODED_FILE.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"INSTALLROOT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"CLRLOADLOGDIR\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"DECODED_FILE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\.NETFRAMEWORK\"; Key: \"USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"decoded_file.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"\n \"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\"","description_v2":["\"decoded_file.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"","\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"","\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"","\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"","\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"","\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" reads file \"%WINDIR%\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Possibly tries to evade analysis by sleeping many times","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Able to identify virtual environment by using API string","Matched sigs: Possibly tries to evade analysis by sleeping many times"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using API string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Possibly tries to evade analysis by sleeping many times"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"$35","description_v2":["\"decoded_file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\"","\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$36","description_v2":["\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UCRTBASE_CLR0400.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSCOREE.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\OLE32.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\BCRYPT.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\CRYPT32.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\CRYPT32.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.DLL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\NTDLL.DLL\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UCRTBASE_CLR0400.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSCOREE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\OLE32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\BCRYPT.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\CRYPT32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\CRYPT32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\NTDLL.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$37","description_v2":["\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.EXE.CONFIG\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FUSION.LOCALGAC\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DECODED_FILE.EXE.LOG\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\KLOASO\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.INI\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Crypto\\OIDINFO\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Crypto\\OIDInfo\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.WINDOWS.FORMS\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\SYSTEM.WINDOWS.FORMS.INI\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.INI\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.DRAWING\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\SYSTEM.DRAWING.INI\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.INI\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.EXE.LOCAL\"","\"decoded_file.exe\" trying to access non-existent file \"C:\\decoded_file.exe.Local\\\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.EXE.CONFIG\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FUSION.LOCALGAC\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\DECODED_FILE.EXE.LOG\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\KLOASO\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.INI\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\OIDINFO\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Crypto\\OIDInfo\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.WINDOWS.FORMS\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\SYSTEM.WINDOWS.FORMS.INI\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.INI\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SYSTEM.DRAWING\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\SYSTEM.DRAWING.INI\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.INI\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\DECODED_FILE.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" trying to access non-existent file \"C:\\decoded_file.exe.Local\\\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"decoded_file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\log.tmp\"\n \"decoded_file.exe\" writes file \"%temp%\\log.tmp\"","description_v2":["\"decoded_file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\log.tmp\"","\"decoded_file.exe\" writes file \"%temp%\\log.tmp\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" writes file \"%TEMP%\\log.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" writes file \"%temp%\\log.tmp\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-52","type":7,"relevance":1,"name":"Contact Dynamic dns (possible C&C communication)","description":"\"madmrx.duckdns.org\"","description_v2":["\"madmrx.duckdns.org\""],"description_v3":[{"type":"text","value":"\"madmrx.duckdns.org\""}],"origin":"Network Traffic","attck_id":"T1102","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1102","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-159","type":0,"relevance":1,"name":"Contains ability to communicate via sockets (Dotnet)","description":"$38","description_v2":["Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_SendBufferSize\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.NetworkStream\" and MemberReference \".ctor\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_RemoteEndPoint\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Dispose\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Poll\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Close\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Add\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Remove\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Item\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Count\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Clear\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_SendBufferSize\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.NetworkStream\" and MemberReference \".ctor\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_RemoteEndPoint\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Dispose\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Poll\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Close\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Add\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Remove\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Item\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Count\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Clear\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001868-00000C29-862153545\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001868-00000C29-862153545\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001868-00000C29-862153545\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-158","type":0,"relevance":1,"name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\"","description_v2":["Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Credentials\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-151","type":0,"relevance":1,"name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"decoded_file.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"decoded_file.exe\"","description_v2":["Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"decoded_file.exe\"","Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-110","type":0,"relevance":1,"name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"decoded_file.exe\"\n Observed namespace \"System.Net\" in \"decoded_file.exe\"\n Observed namespace \"System.Net.Security\" in \"decoded_file.exe\"","description_v2":["Observed namespace \"System.Net.Sockets\" in \"decoded_file.exe\"","Observed namespace \"System.Net\" in \"decoded_file.exe\"","Observed namespace \"System.Net.Security\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed namespace \"System.Net.Sockets\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Net\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed namespace \"System.Net.Security\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"127.0.0.1\"\n Potential IP \"4.0.0.0\" found in string \"ystem,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Xml,4.0.0.0,,b77a5c561934e089,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"27.0.0.1\"","description_v2":["\"1.0.0.0\"","\"127.0.0.1\"","Potential IP \"4.0.0.0\" found in string \"ystem,4.0.0.0,,b77a5c561934e089\"","Potential IP \"4.0.0.0\" found in string \"ystem.Xml,4.0.0.0,,b77a5c561934e089,MSIL\"","Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"","\"2.5.29.19\"","\"2.5.29.14\"","\"27.0.0.1\""],"description_v3":[{"type":"text","value":"\"1.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"127.0.0.1\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"ystem,4.0.0.0,,b77a5c561934e089\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"ystem.Xml,4.0.0.0,,b77a5c561934e089,MSIL\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"\"27.0.0.1\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"Pattern match: \"http://sche\"\n Pattern match: \"mas.microsoft.com/smi/2005/windowssettings\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Heuristic match: \"madmrx.duckdns.org\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Pattern match: \"oft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll\"\n Heuristic match: \"ation.tr\"\n Heuristic match: \"sp.at\"\n Heuristic match: \"??\\c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.fo\"","description_v2":["Pattern match: \"http://sche\"","Pattern match: \"mas.microsoft.com/smi/2005/windowssettings\"","Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"","Heuristic match: \"madmrx.duckdns.org\"","Pattern match: \"microsoft.net/framework/v4.0.30319/\"","Pattern match: \"oft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll\"","Heuristic match: \"ation.tr\"","Heuristic match: \"sp.at\"","Heuristic match: \"??\\c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.fo\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://sche\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"mas.microsoft.com/smi/2005/windowssettings\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"madmrx.duckdns.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/framework/v4.0.30319/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"oft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ation.tr\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sp.at\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"??\\%WINDIR%\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.fo\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","description_v2":["Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"decoded_file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"decoded_file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-141","type":6,"relevance":2,"name":"Calls an API typically used to retrieve computer name","description":"\"decoded_file.exe\" called \"GetComputerNameW\" (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"GetComputerNameW\" (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetComputerNameW\" (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-108","type":6,"relevance":3,"name":"Calls an API typically used to retrieve information about the current system","description":"\"decoded_file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","description_v2":["\"decoded_file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-135","type":6,"relevance":2,"name":"Calls an API typically used to retrieve user name","description":"\"decoded_file.exe\" called \"GetUserNameW\" (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called \"GetUserNameW\" (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"GetUserNameW\" (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-102","type":6,"relevance":5,"name":"Calls an API's typically used for searching a directory for a files","description":"$39","description_v2":["\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindNextFileW\" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindNextFileW\" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindNextFileW\" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindNextFileW\" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\* (UID: 00000000-00001868)","\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Accessibility\\* (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindNextFileW\" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindNextFileW\" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindNextFileW\" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindNextFileW\" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\* (UID: 00000000-00001868)"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Accessibility\\* (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"$3a","description_v2":["Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")","Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; File: \"decoded_file.exe\")","Found string \"FromBase64String\" (Indicator: \"base64\"; File: \"decoded_file.exe\")","Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")","Found string \"ToBase64String\" (Indicator: \"base64\"; File: \"decoded_file.exe\")","Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; File: \"decoded_file.exe\")","Found string \"CryptoStream\" (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")","Found string \"GZipStream\" (Indicator: \"GzipStream\"; File: \"decoded_file.exe\")","Found string \"MD5CryptoServiceProvider\" (Indicator: \"md5cryptoserviceprovider\"; File: \"decoded_file.exe\")","Found string \"RSACryptoServiceProvider\" (Indicator: \"RsaCryptoServiceProvider\"; File: \"decoded_file.exe\")","Found string \"AesCryptoServiceProvider\" (Indicator: \"aes\"; File: \"decoded_file.exe\")","Found string \"AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; File: \"decoded_file.exe\")","Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; File: \"decoded_file.exe\")","Found string \"CreateEncryptor\" (Indicator: \"createencryptor\"; File: \"decoded_file.exe\")","Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")","Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")","Found string \"bKvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==\" (Indicator: \"aes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"aes\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"aescryptoserviceprovider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"base64\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"createdecryptor\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"createencryptor\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"cryptostreammode\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"GzipStream\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"ToBase64String\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"md5cryptoserviceprovider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"RsaCryptoServiceProvider\"; File: \"decoded_file.exe\")","file/memory contains long string with (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")","Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")","Found string \"icrosoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","Found string \"and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","Found string \"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")","Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","Found string \"KvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"CryptoStream\" (Indicator: \"cryptostream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"base64\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"base64\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CryptoStream\" (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GZipStream\" (Indicator: \"GzipStream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MD5CryptoServiceProvider\" (Indicator: \"md5cryptoserviceprovider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RsaCryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AesCryptoServiceProvider\" (Indicator: \"aes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CreateEncryptor\" (Indicator: \"createencryptor\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"bKvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==\" (Indicator: \"aes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aes\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aescryptoserviceprovider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"base64\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"createdecryptor\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"createencryptor\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"cryptostream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"cryptostreammode\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"GzipStream\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ToBase64String\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"md5cryptoserviceprovider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"RsaCryptoServiceProvider\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"System.Security.Cryptography\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"icrosoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"KvsxNBO/GbWxwEd4pSQhMQRzg02J0RJ92UNzDetZmRJJfKdR/TkYYX+ZZMRY3vqKIaEspPNhrfze8+2exiVug==\" (Indicator: \"aes\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CryptoStream\" (Indicator: \"cryptostream\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-163","type":0,"relevance":1,"name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"decoded_file.exe\"","description_v2":["Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"decoded_file.exe\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"decoded_file.exe\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"decoded_file.exe\")","Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"decoded_file.exe\")","Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-100","type":0,"relevance":1,"name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"decoded_file.exe\"\n Observed function \"GetProcessById\" in \"decoded_file.exe\"","description_v2":["Observed function \"get_ProcessName\" in \"decoded_file.exe\"","Observed function \"GetProcessById\" in \"decoded_file.exe\""],"description_v3":[{"type":"text","value":"Observed function \"get_ProcessName\" in \"decoded_file.exe\""},{"type":"linebreak"},{"type":"text","value":"Observed function \"GetProcessById\" in \"decoded_file.exe\""}],"origin":"Static Parser","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")","Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"decoded_file.exe\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"decoded_file.exe\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"decoded_file.exe\")","Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"decoded_file.exe\")","Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-88","type":2,"relevance":1,"name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"decoded_file.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"decoded_file.exe\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"decoded_file.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"decoded_file.exe\")","Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"decoded_file.exe\")","Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"decoded_file.exe\")","Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-107","type":2,"relevance":1,"name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"decoded_file.exe\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"decoded_file.exe\")","Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"stream-136","type":1,"relevance":5,"name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004b-DzpAttNoGmeH~OHvCRuXjtgwh","description_v2":["System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004b-DzpAttNoGmeH~OHvCRuXjtgwh"],"description_v3":[{"type":"text","value":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004b-DzpAttNoGmeH~OHvCRuXjtgwh"}],"origin":"Hybrid Analysis Technology","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-217","type":2,"relevance":1,"name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"decoded_file.exe\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"decoded_file.exe\")","Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \",3185,,GetUserNameW,advapi32\" (Indicator: \"GetUserName\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","description_v2":["Found reference to API \",3185,,GetUserNameW,advapi32\" (Indicator: \"GetUserName\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \",3185,,GetUserNameW,advapi32\" (Indicator: \"GetUserName\"; Source: \"00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-556","type":2,"relevance":1,"name":"Found strings related to keylogger","description":"Found string \"[ESC]\" (Indicator: \"[esc]\"; File: \"decoded_file.exe\")\n Found string \"[CTRL]\" (Indicator: \"[ctrl]\"; File: \"decoded_file.exe\")\n Found string \"[CTRL]\" (Indicator: \"[Ctrl]\"; File: \"decoded_file.exe\")\n Found string \"[Shift]\" (Indicator: \"[shift]\"; File: \"decoded_file.exe\")\n Found string \"[Back]\" (Indicator: \"[Back]\"; File: \"decoded_file.exe\")\n Found string \"[Tab]\" (Indicator: \"[tab]\"; File: \"decoded_file.exe\")\n Found string \"[CAPSLOCK: OFF]\" (Indicator: \"[CAPSLOCK: OFF]\"; File: \"decoded_file.exe\")\n Found string \"[CAPSLOCK: ON]\" (Indicator: \"[CAPSLOCK: ON]\"; File: \"decoded_file.exe\")","description_v2":["Found string \"[ESC]\" (Indicator: \"[esc]\"; File: \"decoded_file.exe\")","Found string \"[CTRL]\" (Indicator: \"[ctrl]\"; File: \"decoded_file.exe\")","Found string \"[CTRL]\" (Indicator: \"[Ctrl]\"; File: \"decoded_file.exe\")","Found string \"[Shift]\" (Indicator: \"[shift]\"; File: \"decoded_file.exe\")","Found string \"[Back]\" (Indicator: \"[Back]\"; File: \"decoded_file.exe\")","Found string \"[Tab]\" (Indicator: \"[tab]\"; File: \"decoded_file.exe\")","Found string \"[CAPSLOCK: OFF]\" (Indicator: \"[CAPSLOCK: OFF]\"; File: \"decoded_file.exe\")","Found string \"[CAPSLOCK: ON]\" (Indicator: \"[CAPSLOCK: ON]\"; File: \"decoded_file.exe\")"],"description_v3":[{"type":"text","value":"Found string \"[ESC]\" (Indicator: \"[esc]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[CTRL]\" (Indicator: \"[ctrl]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[CTRL]\" (Indicator: \"[Ctrl]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[Shift]\" (Indicator: \"[shift]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[Back]\" (Indicator: \"[Back]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[Tab]\" (Indicator: \"[tab]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[CAPSLOCK: OFF]\" (Indicator: \"[CAPSLOCK: OFF]\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[CAPSLOCK: ON]\" (Indicator: \"[CAPSLOCK: ON]\"; File: \"decoded_file.exe\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-507","type":2,"relevance":1,"name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"decoded_file.exe\")\n Found string \"Select * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; File: \"decoded_file.exe\")\n Found string \"elect * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"decoded_file.exe\")","Found string \"Select * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; File: \"decoded_file.exe\")","Found string \"elect * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Select * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"elect * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-111","type":6,"relevance":3,"name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"decoded_file.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001868)","description_v2":["\"decoded_file.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001868)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001868)"}],"origin":"API Call","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"Found string \"\\drivers\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")\n Found string \"\\\\drivers\\\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")","description_v2":["Found string \"\\drivers\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")","Found string \"\\\\drivers\\\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")","Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\\drivers\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\\\drivers\\\\etc\" (Indicator: \"\\drivers\\\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string %WINDIR%\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001868.00000000.117202.02C60000.00000004.mdmp, 00000000-00001868.00000001.119123.02C60000.00000004.mdmp, 00000000-00001868.00000002.121044.02C60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-91","type":2,"relevance":1,"name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"decoded_file.exe\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"decoded_file.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"decoded_file.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"decoded_file.exe\")","Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"decoded_file.exe\")","Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"decoded_file.exe\")","Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-132","type":2,"relevance":1,"name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"decoded_file.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"decoded_file.exe\")","Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"decoded_file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","description_v2":["\"decoded_file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$3b","description_v2":["\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"decoded_file.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","description_v2":["\"decoded_file.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","description_v2":["\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"decoded_file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"string-55","type":2,"relevance":10,"name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"decoded_file.exe\")\n \"elect * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")","description_v2":["\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"decoded_file.exe\")","\"elect * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"decoded_file.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"elect * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001868.00000002.121044.006C2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-47","type":6,"relevance":10,"name":"Possibly tries to evade analysis by sleeping many times","description":"\"decoded_file.exe\" (Thread ID: 4980) slept \"525\" times (threshold: 500)","description_v2":["\"decoded_file.exe\" (Thread ID: 4980) slept \"525\" times (threshold: 500)"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Thread ID: 4980) slept \"525\" times (threshold: 500)"}],"origin":"API Call","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"suricata-1","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain\" (SID: 2042936, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"","description_v2":["Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain\" (SID: 2042936, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\""],"description_v3":[{"type":"text","value":"Detected alert \"ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain\" (SID: 2042936, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"string-63","type":2,"relevance":3,"name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"webextension@metamask.io.xpi\"","description_v2":["Pattern match: \"webextension@metamask.io.xpi\""],"description_v3":[{"type":"text","value":"Pattern match: \"webextension@metamask.io.xpi\""}],"origin":"File/Memory","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]","description_v2":["\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: 00000000-00001868]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-6","type":7,"relevance":5,"name":"Contacts random domain names","description":"\"madmrx.duckdns.org\" seems to be random","description_v2":["\"madmrx.duckdns.org\" seems to be random"],"description_v3":[{"type":"text","value":"\"madmrx.duckdns.org\" seems to be random"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"stream-85","type":1,"relevance":5,"name":"Contains ability to open a port and listen for incoming connection","description":"Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000064-BgPmXPknuIzlhuh~vPNfVNyhLPFgICX\n System.Net.Sockets.Socket::Dispose() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001e-fFvPYfBNDNUVK~ihvzsDnOtljG\n System.Net.Sockets.Socket::get_Connected() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001f-fFvPYfBNDNUVK~yqrMomRCOOE\n System.Net.Sockets.Socket::Poll(System.Int32,System.Net.Sockets.SelectMode) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000020-fFvPYfBNDNUVK~WvOuCeVOjzcEm\n System.Net.Sockets.Socket::Close() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004c-DzpAttNoGmeH~MaoSnziyhmQ\n System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000063-BgPmXPknuIzlhuh~zCZVTyWSdIaUxet\n System.Net.Sockets.Socket::set_ReceiveBufferSize(System.Int32) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001b-fFvPYfBNDNUVK~SJJFnGqEALj","description_v2":["Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000064-BgPmXPknuIzlhuh~vPNfVNyhLPFgICX","System.Net.Sockets.Socket::Dispose() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001e-fFvPYfBNDNUVK~ihvzsDnOtljG","System.Net.Sockets.Socket::get_Connected() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001f-fFvPYfBNDNUVK~yqrMomRCOOE","System.Net.Sockets.Socket::Poll(System.Int32,System.Net.Sockets.SelectMode) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000020-fFvPYfBNDNUVK~WvOuCeVOjzcEm","System.Net.Sockets.Socket::Close() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004c-DzpAttNoGmeH~MaoSnziyhmQ","System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000063-BgPmXPknuIzlhuh~zCZVTyWSdIaUxet","System.Net.Sockets.Socket::set_ReceiveBufferSize(System.Int32) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001b-fFvPYfBNDNUVK~SJJFnGqEALj"],"description_v3":[{"type":"text","value":"Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000064-BgPmXPknuIzlhuh~vPNfVNyhLPFgICX"},{"type":"linebreak"},{"type":"text","value":"System.Net.Sockets.Socket::Dispose() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001e-fFvPYfBNDNUVK~ihvzsDnOtljG"},{"type":"linebreak"},{"type":"text","value":"System.Net.Sockets.Socket::get_Connected() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001f-fFvPYfBNDNUVK~yqrMomRCOOE"},{"type":"linebreak"},{"type":"text","value":"System.Net.Sockets.Socket::Poll(System.Int32,System.Net.Sockets.SelectMode) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000020-fFvPYfBNDNUVK~WvOuCeVOjzcEm"},{"type":"linebreak"},{"type":"text","value":"System.Net.Sockets.Socket::Close() at 88e8cee71f454bc1fa6b3a7741a3bd7d-600004c-DzpAttNoGmeH~MaoSnziyhmQ"},{"type":"linebreak"},{"type":"text","value":"System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at 88e8cee71f454bc1fa6b3a7741a3bd7d-6000063-BgPmXPknuIzlhuh~zCZVTyWSdIaUxet"},{"type":"linebreak"},{"type":"text","value":"System.Net.Sockets.Socket::set_ReceiveBufferSize(System.Int32) at 88e8cee71f454bc1fa6b3a7741a3bd7d-600001b-fFvPYfBNDNUVK~SJJFnGqEALj"}],"origin":"Hybrid Analysis Technology","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"target-412","type":9,"relevance":5,"name":"Spawned process connects to a network","description":"Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 6606 (TCP); Domain: \"madmrx.duckdns.org\"\n Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 8808 (TCP); Domain: \"madmrx.duckdns.org\"\n Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 7707 (TCP); Domain: \"madmrx.duckdns.org\"","description_v2":["Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 6606 (TCP); Domain: \"madmrx.duckdns.org\"","Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 8808 (TCP); Domain: \"madmrx.duckdns.org\"","Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 7707 (TCP); Domain: \"madmrx.duckdns.org\""],"description_v3":[{"type":"text","value":"Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 6606 (TCP); Domain: \"madmrx.duckdns.org\""},{"type":"linebreak"},{"type":"text","value":"Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 8808 (TCP); Domain: \"madmrx.duckdns.org\""},{"type":"linebreak"},{"type":"text","value":"Process \"C:\\decoded_file.exe\" connects to 23.26.108.213 on port 7707 (TCP); Domain: \"madmrx.duckdns.org\""}],"origin":"Monitored Target","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-136","type":3,"relevance":3,"name":"Writes registry keys","description":"\"decoded_file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","description_v2":["\"decoded_file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")"],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"binary-63","type":8,"relevance":5,"name":"Drops a file that contains keystrokes (possible keylogger)","description":"\"Log.tmp\" contains indicator \"[ENTER]\" (Line: 4; Offset: 0)","description_v2":["\"Log.tmp\" contains indicator \"[ENTER]\" (Line: 4; Offset: 0)"],"description_v3":[{"type":"text","value":"\"Log.tmp\" contains indicator \"[ENTER]\" (Line: 4; Offset: 0)"}],"origin":"Binary File","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-8","type":12,"relevance":10,"name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","description_v2":["CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"],"description_v3":[{"type":"text","value":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"binary-11","type":8,"relevance":10,"name":"The analysis extracted a file that was identified as malicious","description":"12/21 Antivirus vendors marked dropped file \"decoded_file.exe\" as malicious (classified as \"Gen:Trojan.Mardom.MN\" with 57% detection rate)","description_v2":["12/21 Antivirus vendors marked dropped file \"decoded_file.exe\" as malicious (classified as \"Gen:Trojan.Mardom.MN\" with 57% detection rate)"],"description_v3":[{"type":"text","value":"12/21 Antivirus vendors marked dropped file \"decoded_file.exe\" as malicious (classified as \"Gen:Trojan.Mardom.MN\" with 57% detection rate)"}],"origin":"Binary File","attck_id":"T1204.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1204/002","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-7","type":7,"relevance":7,"name":"Uses network protocols on unusual ports","description":"TCP traffic to 23.26.108.213 on port 8808\n TCP traffic to 23.26.108.213 on port 7707\n TCP traffic to 23.26.108.213 on port 6606","description_v2":["TCP traffic to 23.26.108.213 on port 8808","TCP traffic to 23.26.108.213 on port 7707","TCP traffic to 23.26.108.213 on port 6606"],"description_v3":[{"type":"text","value":"TCP traffic to 23.26.108.213 on port 8808"},{"type":"linebreak"},{"type":"text","value":"TCP traffic to 23.26.108.213 on port 7707"},{"type":"linebreak"},{"type":"text","value":"TCP traffic to 23.26.108.213 on port 6606"}],"origin":"Network Traffic","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Pattern Matching","identifier":"yara-0","type":13,"relevance":9,"name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00001868\" as \"Detects AsyncRAT\" (Author: ditekSHen)","description_v2":["YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00001868\" as \"Detects AsyncRAT\" (Author: ditekSHen)"],"description_v3":[{"type":"text","value":"YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00001868\" as \"Detects AsyncRAT\" (Author: ditekSHen)"}],"origin":"YARA Signature","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-72","type":6,"relevance":10,"name":"Sets a global windows hook to intercept keystrokes","description":"\"decoded_file.exe\" set a windows hook with filter \"WH_KEYBOARD_LL\"","description_v2":["\"decoded_file.exe\" set a windows hook with filter \"WH_KEYBOARD_LL\""],"description_v3":[{"type":"text","value":"\"decoded_file.exe\" set a windows hook with filter \"WH_KEYBOARD_LL\""}],"origin":"API Call","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"mutant-1","type":4,"relevance":7,"name":"Creates a mutant that is known to appear in malware","description":"\"AsyncMutex_\" in \"AsyncRat\"","description_v2":["\"AsyncMutex_\" in \"AsyncRat\""],"description_v3":[{"type":"text","value":"\"AsyncMutex_\" in \"AsyncRat\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"11.2.2","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["Sets a global windows hook to intercept keystrokes","Found a string that may be used as part of an injection method","Found browser information locations related strings"]},{"name":"Fingerprint","details":["Queries process information"]},{"name":"Evasive","details":["Possibly tries to evade analysis by sleeping many times","Possibly checks for the presence of a forensics/monitoring tool","Found a reference to a WMI query string known to be used for VM detection"]},{"name":"Network Behavior","details":["Contacts 1 domain and 1 host"]}],"icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","visualization":"$3c","classification":["67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.)","9.7% (.EXE) Win64 Executable (generic)","6.0% (.DLL) Win32 Dynamic Link Library (generic)","4.6% (.EXE) Win16 NE executable (generic)","4.1% (.EXE) Win32 Executable (generic)"],"dns_requests":[{"compromised":false,"domain":"madmrx.duckdns.org","address":"23.26.108.213","ttl":60,"country":"United States","registrar_name":"Gandi SAS","registrar_organization":null,"registrar_name_servers":"NS1.DUCKDNS.ORG","registrar_creation_date":"2013-04-12T19:58:56+00:00","who_is":[{"key":"Address","value":"Obfuscated whois Gandi-63-65 boulevard Massena"},{"key":"Address","value":"Gandi, 63-65 boulevard Massena"},{"key":"City","value":"Obfuscated whois Gandi-Paris"},{"key":"Country","value":"FR"},{"key":"Creation Date","value":"2013-04-12T19:58:56"},{"key":"DNSSEC","value":"unsigned"},{"key":"Domain Name","value":"DUCKDNS.ORG"},{"key":"EMail","value":"25e6a5dc339baa71337fd929254287e6-1702436@contact.gandi.net"},{"key":"Expiration Date","value":"2018-04-12T19:58:56"},{"key":"name","value":"Richard Harper"},{"key":"Name Server","value":"NS1.DUCKDNS.ORG"},{"key":"Name Server","value":"NS3.DUCKDNS.ORG"},{"key":"Reigstrar","value":"Gandi SAS"},{"key":"State","value":"Paris"},{"key":"Status","value":"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"},{"key":"Last Update","value":"2017-03-12T18:09:36"},{"key":"Zip Code","value":"75013"}],"associated_sha256s":[]}],"contacted_hosts":[{"compromised":false,"address":"23.26.108.213","port":8808,"protocol":"TCP","associated_runtime":[{"name":"decoded_file.exe","pid":"1868"}],"country":"United States","associated_sha256s":[]},{"compromised":false,"address":"23.26.108.213","port":7707,"protocol":"TCP","associated_runtime":[{"name":"decoded_file.exe","pid":"1868"}],"country":"United States","associated_sha256s":[]},{"compromised":false,"address":"23.26.108.213","port":6606,"protocol":"TCP","associated_runtime":[{"name":"decoded_file.exe","pid":"1868"}],"country":"United States","associated_sha256s":[]}],"contacted_countries":{"countries":["USA"],"coordinates":[]},"port_infos":[{"port":7707,"description":"Killing Floor"},{"port":8808,"description":"EMC2 (Legato) Networker or Sun Solstice Backup"}],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$3d","type":"Ansi","source":"File String Dumps","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"IicgJiBleGl0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyMjICBleHBsb3JlciAjIyNbRU5URVJdW0VOVEVSXVtFTlRFUl1bRU5URVJdW0VOVEVSXQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"Log.tmp","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUFwcERhdGEl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwxNWFmMTZkMzczY2YwNTI4Y2I3NGZjNzNkMzY1ZmRiZlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzI=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHdzMl8zMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxDUllQVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxWRVJTSU9OLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"KGV4dDgsZXh0MTYsZXgzMikgdHlwZSAkYzcsJGM4LCRjOQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"KG5ldmVyIHVzZWQpIHR5cGUgJGMx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC42","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gXCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdGFza2tpbGwuZXhlIC9pbSBjaHJvbWUuZXhlIC9m","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L1FNRVZwaHNkTmsyZnBHdERzWVZ5RSt3VE4vUEowcm9PYU82WTVlRkNSZmFNZ1A3SGZDWm5MOG9LVFdacktnNzBXK1RGSnpMVUpDOE5KK01ROVRXMEE9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjAuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTI3LjAuMC4x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjRMTVJXSTFYUHBqK2FFblJyOVYyZWFzZ0I0SWh4U2U0WlZrN2JlWFltaEIwajdMMkViYjBuSmRmbmhVTzFyMWxvWi9FV2Q1UEpCVGJVVVgyQTBRUzB6WnBmV2lGYTlTL0JEaFpwK1YvTnZHSDVSZ1c1ZUlqQkZPcldySlVvM0s2b3VpOHpkUkRCeml2cGRYVzFwK0tuajBwcVFNRm55ajF3NnNqSHVDWVBxRnJYbEdwVzZxaGczYkM5cEN2Z1dyRm5uZjhMT0hhWmF4UUI0WStLMWFSZHFRa1dJdytBSUthM0dUMkhpQVlKSTROT2NPU2tqYmdlYms0VGtSTURRRlRPYjBBbWphaURmTDZqU0V3VWRHSkxqMXRGSWlsZzRUY3RoNlRWVEQ5MGM9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjYwNiw3NzA3LDg4MDg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$3e","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$3f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEFjdGl2YXRlUG9uZz5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$40","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEJ1ZmZlcj5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEhlYWRlclNpemU+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEludGVydmFsPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PElzQ29ubmVjdGVkPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEtlZXBBbGl2ZT5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE9mZnNldD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFBpbmc+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFJlYWQ+Yl9fMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFJlYWQ+Yl9fMl8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFNlbmRTeW5jPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFNzbENsaWVudD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFRjcENsaWVudD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2Zm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0JhY2td","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPRkZd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPTl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NUUkxd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0VTQ10=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1NoaWZ0XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1RhYl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCIgL3RyICdcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCInICYgZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCaW5hbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCaXRjb2lu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2VyXFxVc2VyIERhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxDb2lub21p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxkcml2ZXJzXFxldGM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxFbGVjdHJ1bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxleHRlbnNpb25zXFx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW8ueHBp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxHb29nbGVcXENocm9tZVxcVXNlciBEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxob3N0cy5iYWNrdXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMZWRnZXIgTGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMb2cudG1w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNaWNyb3NvZnRcXEVkZ2VcXFVzZXIgRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNb3ppbGxhXFxGaXJlZm94XFxQcm9maWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxudVJcXG5vaXNyZVZ0bmVycnVDXFxzd29kbmlXXFx0Zm9zb3JjaU1cXGVyYXd0Zm9T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXGNocm9tZS1leHRlbnNpb246Ly9kamNsY2trZ2xlY2hvb2JsbmdnaGRpbm1lZW1rYmdjaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTdGFibGVcXExvY2FsIEV4dGVuc2lvbiBTZXR0aW5nc1xcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxQcm9maWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxyb290XFxTZWN1cml0eUNlbnRlcjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERlZmF1bHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGRyaXZlcnNcZXRj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEVsZWN0cnVt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGV4dGVuc2lvbnNcd2ViZXh0ZW5zaW9uQG1ldGFtYXNrLmlvLnhwaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEdvb2dsZVxDaHJvbWVcVXNlciBEYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGhvc3RzLmJhY2t1cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExlZGdlciBMaXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExvY2FsIEV4dGVuc2lvbiBTZXR0aW5ncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExvZy50bXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1vemlsbGFcRmlyZWZveFxQcm9maWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XG51Ulxub2lzcmVWdG5lcnJ1Q1xzd29kbmlXXHRmb3NvcmNpTVxlcmF3dGZvUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcY2hyb21lLWV4dGVuc2lvbjovL2RqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2Np","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFByb2ZpbGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XHJvb3RcU2VjdXJpdHlDZW50ZXIy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJyZG1jb0VRcmpE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWNtYWNvZGtqYmRnbW9sZWVib2xtZGpvbmlsa2RiY2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uYDEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUN3emhDdGR5V1d1aUFqZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRDcllQU2tVeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nlc3Npb25FbmRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGxsRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2VzVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWVsV1VUZXdyZW5QVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUV2UGd5S2VlcUlsRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUdkclZnVlFYcW1oRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUhobWdzRHhNTmtp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUloVHd2SmpxSWZaU3Ji","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUpXU3NybU5uYUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWtReEh0RFBFbHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWxxek5CcG5YRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW1DRm5aVmpwemNF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YU5KR2NNTlhFS1h0Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW50aXZpcnVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwRG9tYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnRFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnROdWxsRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bW1ldHJpY0FsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNNdXRleF84NzIzOA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRlQXNDbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXZhc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVZSZW1vdmFsLkNsYXNzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdTIHwgM0xvc2g=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YVh4eUplUGZycnZkbUptSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YVpFdXpWRGRiRkhvYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXpVeGVOT0J3a1Zo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YjNZeVVHWm5NWFU0YjFNeGNFWjNRVzkxYVRSeGJrZFpTRGhQZGxadWNXcz0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFja3Byb3h5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFja1Byb3h5LkNsYXNzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5JbnZva2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5SZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkV4b1BsRXJoVEt1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmZuYWVsbW9tZWltaGxwbWdqbmpvcGhocGtrb2xqcGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmZvSkRWQkdFV20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmZUcllqZ3FFQlpUV0Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmdQbVhQa251SXpsaHVo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkhlVWRoeUdFUXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9FZGdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUVkZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkluY0ZEU1ZxbmpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbiBDb3Jl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbl9Db3Jl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0S2VlcF9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0S2VlcENocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0UGF5X0Nocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0UGF5Q2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkpTdGFQRmJPQWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ykt2c3hOQk8vR2JXeHdFZDRwU1FoTVFSemcwMkowUko5MlVOekRldFptUkpKZktkUi9Ua1lZWCtaWk1SWTN2cUtJYUVzcFBOaHJmemU4KzJleGlWdWc9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tDb3B5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tlZCE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1aZ09GTm1GdFZqclhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym9seWFKeElPY0h6Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qm9vbFdhbGxldHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qk95SURIc0FseEZ6dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlB0akJSVW5jSGp6d0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlFETFoyRWdKRkZXeGFZZXM2K0Q1T1ZnaE1DazRsU1lScGFEeW16SDkwcmtwRmo5eUdFUDhFUHlDRStVRU5vNzhGbHNYQTBvM2Q1TkR1S2ZKMkNadVE9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlJHa3Z4a2NwUmZNVU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnNxcE91WEFjbUN4bm5zSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnVmREFnR3ZKTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnpCR2V3WllqRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qlp2SVBwa1VVS1lu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpdGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpdGVCaW5kZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2NUeU5GWmx5TFRrcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2R4R1NaS3hsWG5FdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENsb3NlU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2dCY3pUVmVyRFJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2dLZkRJU2VtTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2Rl","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2RlQ0JD","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tIb3N0TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2lwaGVyTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y0lUUlBDZVZ1bkZCVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2tVVEd5amFhS0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50SW5mbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y05uVE9PcUZZRmVQaW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29pbmJhc2VfQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29pbmJhc2VDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZU1ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHJlc3Npb25Nb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFNpZFRvU3RyaW5nU2lkVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29SZWdpc3Rlck1lc3NhZ2VGaWx0ZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtQWxsb2M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtRnJlZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3BLaUp6S29kemw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ViS2V5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRDb250ZXh0QWRkUmVm","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3RX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNyeXB0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREdXBsaWNhdGVLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mb1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZXRQcm92UGFyYW0=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvZ3JhcGhpY0V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRRdWVyeU9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTZXRLZXlQYXJhbQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZvRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQmluZGVyRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1NqVnFGdVhkWlR0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1NXUHpGUVFsdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3Rkdk9zUURzQmFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VGY2RTUG5lS3l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudFVzZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1VaR3VDWGZWeFlJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1ZKQlJka3h3aU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1dVVGxLcmZTUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3hSUXdCTkhLRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1lkenVOcVRTTGNtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1lnblZtdXJWc1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1pTY2hOeUdnclU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1p1UVdqVENsWEc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3p3dm5ZamZTWGhTTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1pXWmRPeERGZXVHaEZ2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZEFudWNDRkRER2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZEJPcmhqbWJsUmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$41","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGRtVkNCeGJaQVRt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjb2RlZF9maWxl","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdE1lbWJlckF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU3ViS2V5VHJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlVmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGljb3JkVG9rZW5z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RElmRXlmZWhCcGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcGxheU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG5tcW92T2dyaXBrVVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93T3NySVNkQ1dTVG9Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG94UFVBYXNyS3pBckQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RFdlUW1kaG15Y29tS2Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHpwQXR0Tm9HbWVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWJaQXhvR2dPUXU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWNMWGVqUHZ2cQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWZLVFBkbkdrSllXVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUZYblNNeEtvRm90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZUp4cmdPU3Z0a2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWxlY3RydW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kSW52b2tl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5kc1dpdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJEZWJ1Z01vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZU9ERW1icXVLZk11cXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVFqelViSk5YYkxSQUtZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXFLT1RkcmpYUEds","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXRUWXd2Tk5QVkx6Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXZPVUdCcUZmR1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZVhNZlpnZXNYd0tjWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRWYXJpYWJsZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVpqZ2dkSUlTWE1GWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0JyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0Nocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0VkZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmJqUVVNdEh1b0lKZ014Rw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkNPeE1GYlpDVlNYUkdaaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmRmdlNxckJ4eGZFako=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmRucXFLcFFyYm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmRQWW9kSFZ4UGJnd1BM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmVVa0J4aVl3Yw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkZ2UFlmQk5ETlVWSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFjY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVNoYXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN5c3RlbUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5MU1N0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmluRkJBa3BKTmJybw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmpUbm51YnVwY0pz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaW5hbEJsb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZkxaSUVlTEF2eUdD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm5Qd3plU3VXcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zk9rRXhOTGNvQXVWdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZlFEcEVaeGRQaGhIRWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVNlY29uZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlNCZEhtWUZreQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlRZaURYQkdWR01tTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zldzd2JzdG5xbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlhhYlR4aUdKcWk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnhBVVpmdHRiVUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlhHcnZlY1RvcGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnhoVEZuZVp2VUxMT3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlhraldCdndIcGRtUUd0Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rlh0VmVVWHVORmNoQUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2FObG9WUUFnT3VzYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2JrZkJ2elNuZHJ1eg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0NxU29GZU5FUlY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2RpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2VBd0VMaGZ4amhEUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGVJVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FjdGl2YXRlUG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzQXJyYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzRmxvYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzSW50ZWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0J1ZmZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NoYXJz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Nvbm5lY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnREb21haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Zvcm1hdElE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Z1bGxOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0d1aWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ludGVydmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hY2hpbmVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5Nb2R1bGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5XaW5kb3dUaXRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TRnVsbE5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TVmVyc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NvckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1B1YmxpY0tleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JlbW90ZUVuZFBvaW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlbmRTeW5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NzbENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N5c3RlbURpcmVjdG9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RjcENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVlVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRkckluZm9X","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0SG9zdEFkZHJlc3Nlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW1hZ2VEZWNvZGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdElucHV0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyZW50","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGF0aFJvb3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c2NyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RvY2tPYmplY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcEZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z0V1RUtzRkpMU2tRZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2ZIaWdBZEtOY2dY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2ZrTlNLQ2phVFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0pWV2ZBSW9RU0lM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$42","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z09Tc0V5b1JBTmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z1JIR29VUVdGcGhJaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z1NOUUt5d29CS1ZWcXY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R1ppcFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R1paY3JNZEdtd3lVSExtU08=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aDJ0c2JjdUh4Y2htTXk0QVZua3pGdWdhbTNDU2lYNmQyK2o1dnV1S3hTdnVVcEtUOXovbysreTB6UU5UaVFVYjNVaUJwRVdPNXVaSEcxbTBCMHlHTXc9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEVEc1hUbXNWQWVFcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aEVncmdzVkNZbnRyTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVxR05jRmhqU0VFcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGZSVWtCYWxjT1lBS2lVeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SE1BQ1NIQTI1Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SHBLM2k1bjFCbE1PT2EzQ25VbnJMd081ckZtNzFiSDZFdys0djI3Q2pNSUdiODFTZFdjODRsU2ZuV05ub0Fwd3ZMWmhyd1Qxa1k1ZnNRbTdQbFRXYVE9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFFNTGdEZ0NNbWxV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFRhbXhtRE5nYXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHRaU3hzRGtpbWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aFVFZHFTTHljdE1raw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFdob2tMTVptQ2NiVUxV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHhHelFBQmJPcUtl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFlmZHlkbGhLSHZkaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFlncVpDdVFjZmlV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SHlrQm5KYXpnSXVRdkU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFPQWpBanZ6VnZoeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFzeW5jUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWF6SGFUT25XbmE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWNmdnNlZlpERk9tU0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUNyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUNyeXB0b1RyYW5zZm9ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWRyV01CbGh4bWR5bWdQcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZnd1hRTWNVSVNuckNK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUZwV3p4d3BxZkly","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUd5YXRxZUtaZFp0Wlc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWh2enNEbk90bGpH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWpJRXRSY3pEVUFDaHA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWx1SkZoSEdqSk9TUEU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VDb2RlY0luZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1tMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tQXNzb2NpYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tRGVzdHJveUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tTm90aWZ5SU1F","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tUmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q2FuZGlkYXRlV2luZG93","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5wdXQgY2FuIG5vdCBiZSBudWxsLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBtZXNzYWdlIGF1dGhlbnRpY2F0aW9uIGNvZGUgKE1BQyku","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52b2tlTWVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aU9BbmxMbU1ZRGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJblJvbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JFbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JXaGl0ZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVR3VUtRQ0t3dmo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXVOWEx2Wnd2RXhn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aVhCeXNKRERSalZs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXlJTXh3eFNvd1lnUFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXlOWnpDU3JxdEg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SjFBSE5OV0hvMVIyNy9lZHJYSHJvTzdZTmxMWWVhRU91Uk1DcjI1MGQyRDltWG4vWWZVREdKRVJIOXUwT1EvQWpWWkdZVFJnbGZ1MWI1VmRRMnFVR2c9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SmZ0eWNOQ3ZwSGl5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"amlpZGlhYWxpaG1taGRkamdibmJnZGZmbGVsb2NwYWs=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aklWTUZRSGtPRUtneUZW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkpDbHZvY1ZHUURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ampISEdxQm9hZm9K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"amtqZ2VrY2VmYmtwb2dvaGlna2dvb29kb2xoZGdjZGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm1KSHRGUndwQmI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ak5ERURXSW96VGV2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sk5mdGp0SmRaS0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"am56RnBKWFNLa2lIYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ak9leU1sbUZpbnB5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm9xeWJQdXJZS1ZDcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm9YZktKWkFGcVBWWnNn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SnVBeUFsWHpMVnFKQ2E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"anV4aFpVS2lpVXZqcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"alc2NitxNG5VZm8rNzZDRmdBTFlVZ2QrZnBxb29CL3lRUnM3YW9QTXB4d2hqQ3R2T1FBc2pGUW11TERWUnBaYndPM2Y0UkJHNlZxcCtnTzltNU9RNVJ0aktjNE9yMEVHdnhWN2pYTjg2QzA9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aldBTnp6a0h4TnB5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SndrRXhqdGRHaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2J3UWhNaUFrSWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMQkFTRS5ETEw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2ZBU2duakd0cWxK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2dXd0FHd0pyUG1nVVZG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S0h0b2xzaGtrWng=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFByb3h5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S21Kd1NuV1ViWm9QQmRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S25TSkJqamRGag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a05zUnFySm95bFA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a1FiZ2lXanJDRXpYeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S1RrRXRJRGd1Z3Bv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFzdFRpbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bEJFRVJpRHVOUFdh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENiS3Zjb0VLZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVkZ2VyX0xpdmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVkZ2VyTGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bEVwS1VHTE1HeUpZdnRG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGhuV1dlWEpNYWNFaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TEt3UUZZWlRzdkRZQ2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG1JcUZnemtCcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TE5pYlROV0xrVlVsZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TE9waHJ5dEhLaXc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG94dkVXekF3eGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHJER2tRak1TcWk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TFNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bFZORk9DSlFPQlBqb00=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHdiSGR2U05leU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"THlrVU1iQlplWnJKUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFkbXJ4LmR1Y2tkbnMubw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFkbXJ4LmR1Y2tkbnMub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudEJhc2VPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdFNlYXJjaGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFudWZhY3R1cmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFvU256aXlobVE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmFtZVRvT0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUE=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgICA8ZHBpQXdhcmU+dHJ1ZTwvZHBpQXdhcmU+ICAgIDwvYXNtdjM6d2luZG93c1NldHRpbmdzPiAgPC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFzdGVyS2V5IGNhbiBub3QgYmUgbnVsbCBvciBlbXB0eS4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWRGSG9SQXFzRnp0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWRLeElkVUZUZ3pM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVsSFlkemxoZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9CcmF2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9FZGdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9GaXJlZm94","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9PcGVyYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9PcGVyYUdY","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUJyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUZpcmVmb3g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YU9wZXJh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YU9wZXJhR1g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bUZnYXZ1eWtYbEk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWZTQWpuaGVmQ3Jsbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWdTWnRjR0NJek1u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWljcm9zb2Z0IGNvcnBvcmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXI=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LkNTaGFycA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LkNTaGFycC5SdW50aW1lQmluZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2lj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LldpbjMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUlJRThqQ0NBdHFnQXdJQkFnSVFBUGVXUTRZSjNNdlJlQ0d3THpuN3JUQU5CZ2txaGtpRzl3MEJBUTBGQURBYU1SZ3dGZ1lEVlFRRERBOUJjM2x1WTFKQlZDQlRaWEoyWlhJd0lCY05Nakl3TkRJMU1EQTBNVEE1V2hnUE9UazVPVEV5TXpFeU16VTVOVGxhTUJveEdEQVdCZ05WQkFNTUQwRnplVzVqVWtGVUlGTmxjblpsY2pDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBS1Q5bllZVGpZVFpoWStnMXRla1o4L0YyOWdzRUlEZ2YvOG8=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bUlxR0VuY2NLUXF0VHhTVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bUlSTm9VRmFiaEZp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUp5V2JqcnRJcnlqd3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtuZ2xtTGpLSXhWaldvRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW1MQm5JdkFLb0xIYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU1NcGJpTkNzcW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU95VW5BZlZ0bU5Pamc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVBodmhnV2tWRWs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVFtd3VrVXlKd0U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVJXQXlOdkN2UHZ1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVNPZm5OaE52eVdL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGljYXN0RGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXVtZ1FHd2ViaHlHSXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZpRFVnaWdvY3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdvUGxnbmVra1BQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdUcXhIb1lwRlZ0bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVhnYUFpWFB6c1RL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bkRCZUtQR1ZsUGZZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkVucnNKV2hsYVNZTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya0NyZWRlbnRpYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya1N0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkZCcVFsWlRmWXpEYmM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkZTc3NEc0RFckFsb3FqSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmdiUkZGRVhjSUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmdrV3pPRXRqalZJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkthcmxVS3JyRFJsTVNxZkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmtrVHh1a1FRRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bk1OWlpaSGtCRGdNdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blBOTEhXSWNGdUI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnFqa0xHYndSYkQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blJNTWRQTUp6SmtMdE1G","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blNJekxZZ1lpUVRtT0tO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlRIY2piTFFteW1k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"blZQc1VlbWFOVFpTUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bllmbUN1Z2JSV05sdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnlGVklzZE9kZ2dIQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlpzQndkVlRCb1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2JJV1BXTGVJRUI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2JVc1hPUEtKZUdP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2NnbGtlcGJpYm5hbGJnbWJhY2hrbmdscGRpcGVvaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0h2Q1J1WGp0Z3do","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0ljbHhJdHRTVlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2l4RFZaZmlJVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b0lYZ0hqY0hxaUtpbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b0pjT2VoaEhRTWluSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0puclR5ckFwTnlUag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T29idmlwcWdka01SeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXhwbGljaXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfSW5lcXVhbGl0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1FJZFFQcFJmZUha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3JOS2pJb2FSdXRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3NzTmt3bWhEbmRrRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T1RpTVBnRXJvWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3VaQWp0eUx0aU1rZVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1VadVdLRE5sQ3ZM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1hpZlV5dXNCbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T1h4YlJ3bVBqRllyWkNu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFCS2lqcXRqbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFkZGluZ01vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVyaXplZFRocmVhZFN0YXJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzdGViaW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGJaWWJXd0tpdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGRpVmRtb1hhaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UERvSUdXcXVjdEVRZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyZm9ybWFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEZjc1FpSFB1anBIUHlS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGdFRmJiSG1xeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbV9CcmF2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbUJyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGhiQmNVdnpKQkJC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cElDZHBtQXJoVXFWUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEtlbXRTUU5JYnJsRGJR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEtaSlpEblBzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cExhZ1FlT2lTbHNHbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGx1Z2luLlBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG1FUWtkVEp0UFBRU3di","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG14SWJ0VnVaTkl1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cE9UR1hIa0t5Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cFBWUlRlS3RTVUxoeUc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cFFsWFRxZmhnV2llbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lkVG9TZXNzaW9uSWQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1dpbmRvd1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdG9jb2xUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHNhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cFhpZHdIaHFxZEZ0em8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHhPZ2pmdldQVWtw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cWJPU25pZkNEa0VPWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWpiUFl5ZEJxa1hsUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UUptd3Btc2FvZXV6U2Fi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWpRR0Z1dmNZU0FtRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cUp0dGhxeVd2VGZGUWdC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWtXckhCekh5WGpjVHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cUxFRXRxdVZTTlFU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UW1wUU5lbE54ZHRqZnJs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UW5YSHRYdUVuTnV0Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cW9zbkpjU29PbEY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cVFDenB3QUVWTW9w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXlrYm1jUU1LSXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFiYnlfV2FsbGV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFiYnlXYWxsZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkNvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbEJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbFRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXlQZXJtaXNzaW9uQ2hlY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWYWx1ZUtpbmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlQ2VydGlmaWNhdGVWYWxpZGF0aW9uQ2FsbGJhY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVwQVlrRmpFV1ZkUm1K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXQgSG9zdHMgc3VjY2VlZGVkIQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXQgU2NhbGUgc3VjY2VlZGVkIQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRIb3N0cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRTY2FsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmZjMjg5OERlcml2ZUJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ckdrUUZrc3RQaVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Umd4RklZcHpvUHc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkxNcVpiUUpnQmNhdm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cm5UcnNkR3hnUmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9uaW5fQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9uaW5DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9vVVZVaFNUVFpzUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnJ4WktOS2xTUVht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsU2V0UHJvY2Vzc0lzQ3JpdGljYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlR3WmdyRG9CaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUZpZWxkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUhlbHBlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZVR5cGVIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UndzTWJ3aW5rb1U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cldYbnpSRmZXVERReg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cnhoYk54V2JURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"clpwVXV6a1d2WmxwUk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0FhTVRhdXJDY0pFa0tJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2F2ZVBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0JnYlVra25uU3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2JpZURsbC5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2NiWGdNYkZ2YmdTVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2RTanNUcFlYd3E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBBbnRpdmlydXNQcm9kdWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBXaW4zMl9Db21wdXRlclN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0TW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2VuZFBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c0VyRUZ5dEZleWpJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbkVuZGluZ0V2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbkVuZGluZ0V2ZW50SGFuZGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FjdGl2YXRlUG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzRmxvYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzSW50ZWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0Jsb2NrU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0J1ZmZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWF0ZU5vV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0Vycm9yRGlhbG9n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0hlYWRlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ludGVydmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tleVNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X09mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1BhZGRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1JlY2VpdmVCdWZmZXJTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlbmRCdWZmZXJTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NzbENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1RjcENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1dpbmRvd1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QXBhcnRtZW50U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXhlY3V0aW9uU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c0Z0ZU16bVdDcHhG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2dTalFJUkhiakw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hBMjU2TWFuYWdlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2lpRVBuU2tJVWFV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0pKRm5HcUVBTGo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0psS1NYQmRIVGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U216cWxCRUdWa0N5WQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c05iRU9semhlaVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0VHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U093VnhUZFBxU2FQbnpo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3JhSllkWVRBYXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3JjZHpRRFBackxNdkla","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsUG9saWN5RXJyb3Jz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsUHJvdG9jb2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlQgIiIgIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlQgXCJcIiBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RrdUNGQlhFendabU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nU3BsaXRPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyUmV2ZXJzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1dKaERZRFJ5eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3hSc3RUcmZTWGJWaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhYmxlLkdldEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLmdldF9DdXJyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLk1vdmVOZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLlJlc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuSW1hZ2luZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklPLkNvbXByZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk1hbmFnZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldC5TZWN1cml0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldC5Tb2NrZXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5YNTA5Q2VydGlmaWNhdGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRXZlbnRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c1pORkdWRUxweEF2Zk1Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VEJHd1dJa011S1pHQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGJTSU9ZWlJmQWhFVlBTcnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGNPU25Jd0RUQ0k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGN2Z2NRdkJjY0RJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VEV4RUFNcmRja1FDZk5H","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dEZNUkhCeG1xYUVjSHI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGZOQnFtRWtxaVd4WE0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGltZW91dCAzID4gTlVM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGltZXJDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGltZVNwYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dEtpV29naXNSV0Z3UFRH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG1ndGlLTnpYTnl1b0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VE5pdkNrWXVQbXlibA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG5vTElxcnZ5cW1qT1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG5QY0ZQU2RhVVNC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VE50UE9RVWRxRUh1dVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CaW5hcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Cb29sZWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9TaW5nbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9TdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50MTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50MzI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50NjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VcHBlckludmFyaWFudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dFF1SkZYcmNJVlJq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJvbkxpbmtDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RfQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHVlcWRQQXhFSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHV3VUNSRHZoTXhrYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFZtVEp3aU5yY1h3cU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHhjZXNBQ0JwV2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFlJS2pOalB4VEVOVW1W","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFpuR3NCdnJZdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dFpzeVdveVdmcWJEQXVH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dWFsd3h0S1JQd2tuSGlO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dWJoRHZDakpzeExu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWJyeHhtZWhLeHZF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUJ2VFlycUFtdHRXSFM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUJ4bHZzY3FrTnFG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUV4UVlWSGNRdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUpTY2xZYVdjZWZQTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUxNUm92WlBvU1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUxOTEFyMEI0ZE8xK1lGeEx3SlQ3SUtFL0xzcE5LQld3WXpic2pYMWV2SHJueXpoMk9JSGRDZFhtcFFqbjNGcnRNWFMrU2hTSmpMZWZWTHFEWDlqS1E9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5ob29rV2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VU9HWWVXaFJ3dmdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVBLdHhVS2NVYnA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVB1bHJQYXZUQXlpbUZT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dVFLc2dXSnlMaEZlbWNhSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVF5cmRkQml5bnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXJpSG9zdE5hbWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXNJbklBemJKaVZDSGo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dVNyUWhMUHdYTGFIUUJy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVRGOEVuY29kaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXVibXpNaHFjUnhPWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVdlMzF1SXU1cnlGZ2g1dVhiTmdwTkx0OGxTc2VXZm1iSk13dmVialA3OUJZSlZScWJ4WkRiTDdqU1hHQkRJcHBtR0dpOFJMcVdBN20zV3hVaHRUK2pMcVBtZzNUOHF4bUpsdmgxZFJqWHExZk1DcGNrMHJEOWtqUmQ2ZFM0ZXlYUjYyNU1ZWnhaRHlTT2cwTkh3TjZub2tMVTcydm5haGwvOHV1VnRPK3NNRENhUGtMRlR1VVYzV2ViS1dJMHJaczd0YmZ0Ky9RNXZtaWQ5a001QW5IeURjUlRwLzc1SEU0Sy9CdzZTT3pUa044Wjh0WUxoRi9kM09hSjZUT3FCQk85Zmk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXh4bHJaVlFVRGNiRWV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"djFoUUNyekIxWjA9","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"djQuMC4zMDMxOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmFsZUxYdHpBaVpoYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkJpU0tVSEd6SW5tZFpL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmJ2cnRMV2ZzWkdK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmNYZ1p4RktRRk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmVyaWZ5SGFzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkZnTFJJUlV1eHVi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dkZPRmZieVhPaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmZwb3ZudENjTWVWQkFi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbEJveA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkpkdnlGWnZ6clI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkttY2htRGpmaXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VktNVnRiQnpLRkFC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dktVYVl3RG90UldXSmM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlBnVXJTa1l0S2JXQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlBOZlZOeWhMUEZnSUNY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlFqRUlMZmNvSlNK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnNSZHFXU0dOVHNPYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dnVpSHJpZVBxeExqdHZhZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnZEa3lQTFdiQXdDaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnZoYVFLc1liVW1CaVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlZIWnBjS1VaR1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VldIU3dnWGZ5TU11Ug==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhDaGRud0ZlSnJXdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhVcXNkblh6cGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhYb0hMRXlabmRW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlpZRERxQVFreHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEhhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FPZFRxd0p3dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0RFeGNsdXNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQnJvd3NlclBhc3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2Vib1diemJkRW1xY3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0ZlQU9TU2hiR2pYR0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2ZLWU1OallsTVlneg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ZSQ2FDTmJXenVpUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0lmeTJ5bzdpaFFOMm9uM1krUXBvZ0daMEtUYm5NeUI4Q1ZvYUZzR2JYem5DRENwMkdkeWlDcWE0VUdKQlNJby9ZZ2dOeHRqOEV5TktLLyt6djFsK3cxVE52UUhQMjNyd0diMW1xRFBoU0E9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0J1aWx0SW5Sb2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0lkZW50aXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c1ByaW5jaXBhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d0tscU92WVB2VWlEUGlXR04=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d0xMaUdiSGJORnBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d21Yck5xWFdjTktCZFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05IZ05UZGp4cW5TQ3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05KcndKZlN2R1p4RE9PSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05RSHhDSVdhTmtJbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1BuR0xDU0VnWlJUS1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1FrV2FxeUh5RFJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVCeXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVMaW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3MyXzMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBQ29ubmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBRXZlbnRTZWxlY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3NlR2dzV2d1VEVaWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1RmVWNEVU9GeVI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3ZPdUNlVk9qemNFbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3Z6RUJxZHBrUFNlVm5kTldO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1hqRkFwZWJibUxW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1lmcEhpb1dOSEs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1ptb2daQnNRalQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3pzZ1VIZzJNNlgvbVRiT3cxWXNINGJYRHpUQVoyZDF6d0RqeU5uaU9OM2w4M2FjaFFQWlQ4M1NCanBjS3dqN3Q4Y1RiTmJkQngweUlndFZEU2grR2c9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRlMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRlQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNoYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WGFHTXpYQ015SW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WEFUS1ppeUFBeVBx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eENQZkNWdm9rQnlKSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eGZEcFZUbHhCZ2FFWE9U","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WEhmdHB6UkRieUxF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eElUdXJQa2ZGSnJiYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eGtGUWhsTG1LalRUWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WE1FcnJnV2t4Vlh3aFpG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WE9RTHVDQmZNQXpwTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFBveXF1ckh4U2FReg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WHBzVWFqTm5JUHNJSGc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFFkRFhIWU1lbFJVUkx1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WHJsZXJSTVJ0WXBW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRmZ2VpV1RkRnRUVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRxQklSWERPdlA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRXbmJLY1laYXZ0Zlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFhjVHR4TlVRdGFpS3Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eFljV0tlT3pTTHdJclk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFlmRFd5S1NEVURMQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eHpTQmxGQ2FoQ0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eWVEdWFkY1Fuc0FoTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WUVUQ0hEa3JYQVFDWnI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eUl0TmxBak9KblNyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eU9HU2JpR0ZHUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WXBRYVZlYUhDRER2Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXFyTW9tUkNPT0U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXF1akRDeFV6cnVZWGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eVJaV3RETktndHdV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eVNYRmtNcUdBQUpMUHRwaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WXh2TVZhaUl5VmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekJIRWZOSVNYbVBrag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekNaVlR5V1NkSWFVeGV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WmRER0xhb25Scw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekdrWFJHQlVCblhueA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WkhFZ2JIeWxIcndG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekhwdm5XemhLVmZLQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"emlUYk5CTExkWkZVbUts","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekpBQ3R3TXBBUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WktuaHFoZ0NNTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wk1NY0ZvVGNFRHRIdVFK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wm1WQWZ0a1p6enpCREo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ek5HaXZnSlN1bA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wm5rRFhvT256YlpQSFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wk94a29SZkN2V3V0TnI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WlBOb0ZZUWhJd2lo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elBPWXBYalZnYkk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elJvRVVzVWtJT3dSa1dp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"enJaamRtQm15Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elR4YXRQR0JTeWZFZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"enVLWkF4a2ZTQlNjRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"endYemtUZFFGbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WllqQmlyeWVIc0hETQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"w6LCgMKZSFlCUklE","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"IyMjICBleHBsb3JlciAjIyNbRU5URVJdW0VOVEVSXVtFTlRFUl1bRU5URVJdW0VOVEVSXQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"Log.tmp","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwxNWFmMTZkMzczY2YwNTI4Y2I3NGZjNzNkMzY1ZmRiZlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzI=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHdzMl8zMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxDUllQVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxWRVJTSU9OLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC42","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gXCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdGFza2tpbGwuZXhlIC9pbSBjaHJvbWUuZXhlIC9m","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjAuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTI3LjAuMC4x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$43","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0JhY2td","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPRkZd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPTl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NUUkxd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0VTQ10=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1NoaWZ0XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1RhYl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCaW5hbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2VyXFxVc2VyIERhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxkcml2ZXJzXFxldGM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxleHRlbnNpb25zXFx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW8ueHBp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxHb29nbGVcXENocm9tZVxcVXNlciBEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNaWNyb3NvZnRcXEVkZ2VcXFVzZXIgRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNb3ppbGxhXFxGaXJlZm94XFxQcm9maWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxudVJcXG5vaXNyZVZ0bmVycnVDXFxzd29kbmlXXFx0Zm9zb3JjaU1cXGVyYXd0Zm9T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXGNocm9tZS1leHRlbnNpb246Ly9kamNsY2trZ2xlY2hvb2JsbmdnaGRpbm1lZW1rYmdjaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTdGFibGVcXExvY2FsIEV4dGVuc2lvbiBTZXR0aW5nc1xcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxyb290XFxTZWN1cml0eUNlbnRlcjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGRyaXZlcnNcZXRj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGV4dGVuc2lvbnNcd2ViZXh0ZW5zaW9uQG1ldGFtYXNrLmlvLnhwaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEdvb2dsZVxDaHJvbWVcVXNlciBEYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExvY2FsIEV4dGVuc2lvbiBTZXR0aW5ncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1vemlsbGFcRmlyZWZveFxQcm9maWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XG51Ulxub2lzcmVWdG5lcnJ1Q1xzd29kbmlXXHRmb3NvcmNpTVxlcmF3dGZvUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcY2hyb21lLWV4dGVuc2lvbjovL2RqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2Np","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWNtYWNvZGtqYmRnbW9sZWVib2xtZGpvbmlsa2RiY2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW50aXZpcnVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bW1ldHJpY0FsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNNdXRleF84NzIzOA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXZhc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmZuYWVsbW9tZWltaGxwbWdqbmpvcGhocGtrb2xqcGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9FZGdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUVkZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkluY0ZEU1ZxbmpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ykt2c3hOQk8vR2JXeHdFZDRwU1FoTVFSemcwMkowUko5MlVOekRldFptUkpKZktkUi9Ua1lZWCtaWk1SWTN2cUtJYUVzcFBOaHJmemU4KzJleGlWdWc9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpdGVCaW5kZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50SW5mbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZU1ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHJlc3Npb25Nb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29SZWdpc3Rlck1lc3NhZ2VGaWx0ZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ViS2V5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREdXBsaWNhdGVLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mb1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZXRQcm92UGFyYW0=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvZ3JhcGhpY0V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTZXRLZXlQYXJhbQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZvRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQmluZGVyRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1lkenVOcVRTTGNtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU3ViS2V5VHJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RFdlUW1kaG15Y29tS2Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN5c3RlbUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmluRkJBa3BKTmJybw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FjdGl2YXRlUG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzQXJyYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzRmxvYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzSW50ZWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0J1ZmZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NoYXJz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Nvbm5lY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnREb21haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Zvcm1hdElE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Z1bGxOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0d1aWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ludGVydmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hY2hpbmVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5Nb2R1bGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5XaW5kb3dUaXRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TRnVsbE5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TVmVyc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NvckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1B1YmxpY0tleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JlbW90ZUVuZFBvaW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlbmRTeW5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NzbENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N5c3RlbURpcmVjdG9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RjcENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVlVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRkckluZm9X","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0SG9zdEFkZHJlc3Nlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW1hZ2VEZWNvZGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdElucHV0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyZW50","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGF0aFJvb3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c2NyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RvY2tPYmplY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcEZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R1ppcFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aEVncmdzVkNZbnRyTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVxR05jRmhqU0VFcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SE1BQ1NIQTI1Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VDb2RlY0luZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJblJvbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TFNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFkbXJ4LmR1Y2tkbnMub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUE=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgICA8ZHBpQXdhcmU+dHJ1ZTwvZHBpQXdhcmU+ICAgIDwvYXNtdjM6d2luZG93c1NldHRpbmdzPiAgPC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFzdGVyS2V5IGNhbiBub3QgYmUgbnVsbCBvciBlbXB0eS4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LkNTaGFycC5SdW50aW1lQmluZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2lj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUlJRThqQ0NBdHFnQXdJQkFnSVFBUGVXUTRZSjNNdlJlQ0d3THpuN3JUQU5CZ2txaGtpRzl3MEJBUTBGQURBYU1SZ3dGZ1lEVlFRRERBOUJjM2x1WTFKQlZDQlRaWEoyWlhJd0lCY05Nakl3TkRJMU1EQTBNVEE1V2hnUE9UazVPVEV5TXpFeU16VTVOVGxhTUJveEdEQVdCZ05WQkFNTUQwRnplVzVqVWtGVUlGTmxjblpsY2pDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBS1Q5bllZVGpZVFpoWStnMXRla1o4L0YyOWdzRUlEZ2YvOG8=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TU1NcGJpTkNzcW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2NnbGtlcGJpYm5hbGJnbWJhY2hrbmdscGRpcGVvaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzdGViaW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lkVG9TZXNzaW9uSWQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1dpbmRvd1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkNvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXlQZXJtaXNzaW9uQ2hlY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWYWx1ZUtpbmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlQ2VydGlmaWNhdGVWYWxpZGF0aW9uQ2FsbGJhY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmZjMjg5OERlcml2ZUJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsU2V0UHJvY2Vzc0lzQ3JpdGljYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2JpZURsbC5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBBbnRpdmlydXNQcm9kdWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBXaW4zMl9Db21wdXRlclN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbkVuZGluZ0V2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0Vycm9yRGlhbG9n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tleVNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXhlY3V0aW9uU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hBMjU2TWFuYWdlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsUG9saWN5RXJyb3Jz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhYmxlLkdldEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLmdldF9DdXJyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklPLkNvbXByZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5YNTA5Q2VydGlmaWNhdGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VEV4RUFNcmRja1FDZk5H","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CaW5hcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUxOTEFyMEI0ZE8xK1lGeEx3SlQ3SUtFL0xzcE5LQld3WXpic2pYMWV2SHJueXpoMk9JSGRDZFhtcFFqbjNGcnRNWFMrU2hTSmpMZWZWTHFEWDlqS1E9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5ob29rV2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0ZlQU9TU2hiR2pYR0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WEhmdHB6UkRieUxF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"decoded_file.exe","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$44","type":"Ansi","source":"File String Dumps","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"IicgJiBleGl0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUFwcERhdGEl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"KGV4dDgsZXh0MTYsZXgzMikgdHlwZSAkYzcsJGM4LCRjOQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"KG5ldmVyIHVzZWQpIHR5cGUgJGMx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgNC42","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4gXCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdGFza2tpbGwuZXhlIC9pbSBjaHJvbWUuZXhlIC9m","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"L1FNRVZwaHNkTmsyZnBHdERzWVZ5RSt3VE4vUEowcm9PYU82WTVlRkNSZmFNZ1A3SGZDWm5MOG9LVFdacktnNzBXK1RGSnpMVUpDOE5KK01ROVRXMEE9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MS4wLjAuMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTI3LjAuMC4x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjRMTVJXSTFYUHBqK2FFblJyOVYyZWFzZ0I0SWh4U2U0WlZrN2JlWFltaEIwajdMMkViYjBuSmRmbmhVTzFyMWxvWi9FV2Q1UEpCVGJVVVgyQTBRUzB6WnBmV2lGYTlTL0JEaFpwK1YvTnZHSDVSZ1c1ZUlqQkZPcldySlVvM0s2b3VpOHpkUkRCeml2cGRYVzFwK0tuajBwcVFNRm55ajF3NnNqSHVDWVBxRnJYbEdwVzZxaGczYkM5cEN2Z1dyRm5uZjhMT0hhWmF4UUI0WStLMWFSZHFRa1dJdytBSUthM0dUMkhpQVlKSTROT2NPU2tqYmdlYms0VGtSTURRRlRPYjBBbWphaURmTDZqU0V3VWRHSkxqMXRGSWlsZzRUY3RoNlRWVEQ5MGM9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$45","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$46","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEFjdGl2YXRlUG9uZz5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEJ1ZmZlcj5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEhlYWRlclNpemU+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEludGVydmFsPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PElzQ29ubmVjdGVkPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEtlZXBBbGl2ZT5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE9mZnNldD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFBpbmc+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFJlYWQ+Yl9fMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFJlYWQ+Yl9fMl8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFNlbmRTeW5jPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFNzbENsaWVudD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFRjcENsaWVudD5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2Zm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0JhY2td","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPRkZd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NBUFNMT0NLOiBPTl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NUUkxd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0VTQ10=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1NoaWZ0XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1RhYl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCIgL3RyICdcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCInICYgZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCaW5hbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCaXRjb2lu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxCcmF2ZVNvZnR3YXJlXFxCcmF2ZS1Ccm93c2VyXFxVc2VyIERhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxDb2lub21p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxkcml2ZXJzXFxldGM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxFbGVjdHJ1bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxleHRlbnNpb25zXFx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW8ueHBp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxHb29nbGVcXENocm9tZVxcVXNlciBEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxob3N0cy5iYWNrdXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMZWRnZXIgTGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxMb2cudG1w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNaWNyb3NvZnRcXEVkZ2VcXFVzZXIgRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxNb3ppbGxhXFxGaXJlZm94XFxQcm9maWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxudVJcXG5vaXNyZVZ0bmVycnVDXFxzd29kbmlXXFx0Zm9zb3JjaU1cXGVyYXd0Zm9T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXGNocm9tZS1leHRlbnNpb246Ly9kamNsY2trZ2xlY2hvb2JsbmdnaGRpbm1lZW1rYmdjaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgR1ggU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTb2Z0d2FyZVxcT3BlcmEgU3RhYmxlXFxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcXG5rYmloZmJlb2dhZWFvZWhsZWZua29kYmVmZ3Bna25u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxPcGVyYSBTdGFibGVcXExvY2FsIEV4dGVuc2lvbiBTZXR0aW5nc1xcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxQcm9maWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxyb290XFxTZWN1cml0eUNlbnRlcjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERlZmF1bHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGRyaXZlcnNcZXRj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEVsZWN0cnVt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGV4dGVuc2lvbnNcd2ViZXh0ZW5zaW9uQG1ldGFtYXNrLmlvLnhwaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEdvb2dsZVxDaHJvbWVcVXNlciBEYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XGhvc3RzLmJhY2t1cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExlZGdlciBMaXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExvY2FsIEV4dGVuc2lvbiBTZXR0aW5ncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XExvZy50bXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1vemlsbGFcRmlyZWZveFxQcm9maWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XG51Ulxub2lzcmVWdG5lcnJ1Q1xzd29kbmlXXHRmb3NvcmNpTVxlcmF3dGZvUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcY2hyb21lLWV4dGVuc2lvbjovL2RqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2Np","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE9wZXJhIFN0YWJsZVxMb2NhbCBFeHRlbnNpb24gU2V0dGluZ3NcZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2k=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFByb2ZpbGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"XHJvb3RcU2VjdXJpdHlDZW50ZXIy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJyZG1jb0VRcmpE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWNtYWNvZGtqYmRnbW9sZWVib2xtZGpvbmlsa2RiY2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uYDEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUN3emhDdGR5V1d1aUFqZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRDcllQU2tVeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nlc3Npb25FbmRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWVsV1VUZXdyZW5QVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUV2UGd5S2VlcUlsRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUdkclZnVlFYcW1oRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUhobWdzRHhNTmtp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUloVHd2SmpxSWZaU3Ji","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUpXU3NybU5uYUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWtReEh0RFBFbHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWxxek5CcG5YRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW1DRm5aVmpwemNF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YU5KR2NNTlhFS1h0Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW50aXZpcnVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwRG9tYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnRFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnROdWxsRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bW1ldHJpY0FsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRlQXNDbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXZhc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVZSZW1vdmFsLkNsYXNzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YVh4eUplUGZycnZkbUptSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YVpFdXpWRGRiRkhvYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXpVeGVOT0J3a1Zo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YjNZeVVHWm5NWFU0YjFNeGNFWjNRVzkxYVRSeGJrZFpTRGhQZGxadWNXcz0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFja3Byb3h5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFja1Byb3h5LkNsYXNzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5JbnZva2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5SZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkV4b1BsRXJoVEt1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmZuYWVsbW9tZWltaGxwbWdqbmpvcGhocGtrb2xqcGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmZvSkRWQkdFV20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmZUcllqZ3FFQlpUV0Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmdQbVhQa251SXpsaHVo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkhlVWRoeUdFUXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZV9FZGdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYW5jZUVkZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkluY0ZEU1ZxbmpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbiBDb3Jl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbl9Db3Jl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0S2VlcF9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0S2VlcENocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0UGF5X0Nocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0UGF5Q2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkpTdGFQRmJPQWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ykt2c3hOQk8vR2JXeHdFZDRwU1FoTVFSemcwMkowUko5MlVOekRldFptUkpKZktkUi9Ua1lZWCtaWk1SWTN2cUtJYUVzcFBOaHJmemU4KzJleGlWdWc9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tDb3B5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tlZCE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1aZ09GTm1GdFZqclhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym9seWFKeElPY0h6Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qm9vbFdhbGxldHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qk95SURIc0FseEZ6dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlB0akJSVW5jSGp6d0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlFETFoyRWdKRkZXeGFZZXM2K0Q1T1ZnaE1DazRsU1lScGFEeW16SDkwcmtwRmo5eUdFUDhFUHlDRStVRU5vNzhGbHNYQTBvM2Q1TkR1S2ZKMkNadVE9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YlJHa3Z4a2NwUmZNVU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnNxcE91WEFjbUN4bm5zSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnVmREFnR3ZKTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnpCR2V3WllqRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qlp2SVBwa1VVS1lu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpdGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpdGVCaW5kZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2NUeU5GWmx5TFRrcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2R4R1NaS3hsWG5FdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2dCY3pUVmVyRFJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2dLZkRJU2VtTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tIb3N0TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2lwaGVyTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y0lUUlBDZVZ1bkZCVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2tVVEd5amFhS0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50SW5mbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y05uVE9PcUZZRmVQaW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29pbmJhc2VfQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29pbmJhc2VDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZU1ldGhvZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHJlc3Npb25Nb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3BLaUp6S29kemw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGVjcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5jcnlwdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ViS2V5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvQ29uZmln","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvZ3JhcGhpY0V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRvU3RyZWFtTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQXJndW1lbnRJbmZvRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NoYXJwQmluZGVyRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1NqVnFGdVhkWlR0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1NXUHpGUVFsdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3Rkdk9zUURzQmFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VGY2RTUG5lS3l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudFVzZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1VaR3VDWGZWeFlJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1ZKQlJka3h3aU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1dVVGxLcmZTUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3hSUXdCTkhLRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1lkenVOcVRTTGNtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1lnblZtdXJWc1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1pTY2hOeUdnclU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1p1UVdqVENsWEc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3p3dm5ZamZTWGhTTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y1pXWmRPeERGZXVHaEZ2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZEFudWNDRkRER2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZEJPcmhqbWJsUmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$48","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGRtVkNCeGJaQVRt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdE1lbWJlckF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU3ViS2V5VHJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlVmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGljb3JkVG9rZW5z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RElmRXlmZWhCcGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcGxheU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG5tcW92T2dyaXBrVVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93T3NySVNkQ1dTVG9Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG94UFVBYXNyS3pBckQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RFdlUW1kaG15Y29tS2Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHpwQXR0Tm9HbWVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWJaQXhvR2dPUXU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWNMWGVqUHZ2cQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWZLVFBkbkdrSllXVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUZYblNNeEtvRm90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZUp4cmdPU3Z0a2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWxlY3RydW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5kSW52b2tl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5kc1dpdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJEZWJ1Z01vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZU9ERW1icXVLZk11cXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVFqelViSk5YYkxSQUtZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXFLT1RkcmpYUEds","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXRUWXd2Tk5QVkx6Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXZPVUdCcUZmR1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZVhNZlpnZXNYd0tjWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRWYXJpYWJsZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVpqZ2dkSUlTWE1GWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0JyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0Nocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhX0VkZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RjJhQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmJqUVVNdEh1b0lKZ014Rw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkNPeE1GYlpDVlNYUkdaaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmRmdlNxckJ4eGZFako=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmRucXFLcFFyYm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmRQWW9kSFZ4UGJnd1BM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmVVa0J4aVl3Yw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkZ2UFlmQk5ETlVWSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFjY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVNoYXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN5c3RlbUluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmluRkJBa3BKTmJybw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmpUbm51YnVwY0pz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaW5hbEJsb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkxaSUVlTEF2eUdD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm5Qd3plU3VXcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zk9rRXhOTGNvQXVWdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlFEcEVaeGRQaGhIRWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3JrRGlzcGxheU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVNlY29uZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlNCZEhtWUZreQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlRZaURYQkdWR01tTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zldzd2JzdG5xbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlhhYlR4aUdKcWk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnhBVVpmdHRiVUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlhHcnZlY1RvcGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnhoVEZuZVp2VUxMT3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlhraldCdndIcGRtUUd0Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rlh0VmVVWHVORmNoQUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2FObG9WUUFnT3VzYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2JrZkJ2elNuZHJ1eg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0NxU29GZU5FUlY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2VBd0VMaGZ4amhEUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGVJVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FjdGl2YXRlUG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzQXJyYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzRmxvYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzSW50ZWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FzU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0J1ZmZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NoYXJz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Nvbm5lY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnREb21haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Zvcm1hdElE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Z1bGxOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0d1aWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hlYWRlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ludGVydmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzNjRCaXRPcGVyYXRpbmdTeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01hY2hpbmVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5Nb2R1bGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5XaW5kb3dUaXRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TRnVsbE5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X09TVmVyc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2Nlc3NvckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1B1YmxpY0tleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1JlbW90ZUVuZFBvaW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlbmRTeW5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NzbENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N5c3RlbURpcmVjdG9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RjcENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1ZhbHVlVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SG9zdEFkZHJlc3Nlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW1hZ2VEZWNvZGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdElucHV0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGF0aFJvb3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0J5SWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c2NyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcEZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z0V1RUtzRkpMU2tRZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2ZIaWdBZEtOY2dY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2ZrTlNLQ2phVFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0pWV2ZBSW9RU0lM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"$49","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z09Tc0V5b1JBTmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z1JIR29VUVdGcGhJaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z1NOUUt5d29CS1ZWcXY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R1ppcFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"R1paY3JNZEdtd3lVSExtU08=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aDJ0c2JjdUh4Y2htTXk0QVZua3pGdWdhbTNDU2lYNmQyK2o1dnV1S3hTdnVVcEtUOXovbysreTB6UU5UaVFVYjNVaUJwRVdPNXVaSEcxbTBCMHlHTXc9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEVEc1hUbXNWQWVFcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aEVncmdzVkNZbnRyTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVxR05jRmhqU0VFcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGZSVWtCYWxjT1lBS2lVeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SE1BQ1NIQTI1Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SHBLM2k1bjFCbE1PT2EzQ25VbnJMd081ckZtNzFiSDZFdys0djI3Q2pNSUdiODFTZFdjODRsU2ZuV05ub0Fwd3ZMWmhyd1Qxa1k1ZnNRbTdQbFRXYVE9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFFNTGdEZ0NNbWxV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFRhbXhtRE5nYXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHRaU3hzRGtpbWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aFVFZHFTTHljdE1raw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFdob2tMTVptQ2NiVUxV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHhHelFBQmJPcUtl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFlmZHlkbGhLSHZkaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFlncVpDdVFjZmlV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SHlrQm5KYXpnSXVRdkU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFPQWpBanZ6VnZoeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFzeW5jUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWF6SGFUT25XbmE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWNmdnNlZlpERk9tU0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUNyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUNyeXB0b1RyYW5zZm9ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWRyV01CbGh4bWR5bWdQcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZnd1hRTWNVSVNuckNK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUZwV3p4d3BxZkly","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUd5YXRxZUtaZFp0Wlc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWh2enNEbk90bGpH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWpJRXRSY3pEVUFDaHA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWx1SkZoSEdqSk9TUEU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VDb2RlY0luZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5wdXQgY2FuIG5vdCBiZSBudWxsLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBtZXNzYWdlIGF1dGhlbnRpY2F0aW9uIGNvZGUgKE1BQyku","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52b2tlTWVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aU9BbmxMbU1ZRGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJblJvbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JFbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNOdWxsT3JXaGl0ZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVR3VUtRQ0t3dmo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXVOWEx2Wnd2RXhn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aVhCeXNKRERSalZs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXlJTXh3eFNvd1lnUFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXlOWnpDU3JxdEg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SjFBSE5OV0hvMVIyNy9lZHJYSHJvTzdZTmxMWWVhRU91Uk1DcjI1MGQyRDltWG4vWWZVREdKRVJIOXUwT1EvQWpWWkdZVFJnbGZ1MWI1VmRRMnFVR2c9PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SmZ0eWNOQ3ZwSGl5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"amlpZGlhYWxpaG1taGRkamdibmJnZGZmbGVsb2NwYWs=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aklWTUZRSGtPRUtneUZW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkpDbHZvY1ZHUURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ampISEdxQm9hZm9K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"amtqZ2VrY2VmYmtwb2dvaGlna2dvb29kb2xoZGdjZGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm1KSHRGUndwQmI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ak5ERURXSW96VGV2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sk5mdGp0SmRaS0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"am56RnBKWFNLa2lIYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ak9leU1sbUZpbnB5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm9xeWJQdXJZS1ZDcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sm9YZktKWkFGcVBWWnNn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SnVBeUFsWHpMVnFKQ2E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"anV4aFpVS2lpVXZqcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"alc2NitxNG5VZm8rNzZDRmdBTFlVZ2QrZnBxb29CL3lRUnM3YW9QTXB4d2hqQ3R2T1FBc2pGUW11TERWUnBaYndPM2Y0UkJHNlZxcCtnTzltNU9RNVJ0aktjNE9yMEVHdnhWN2pYTjg2QzA9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"aldBTnp6a0h4TnB5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"SndrRXhqdGRHaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2J3UWhNaUFrSWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2ZBU2duakd0cWxK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2dXd0FHd0pyUG1nVVZG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S0h0b2xzaGtrWng=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFByb3h5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S21Kd1NuV1ViWm9QQmRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S25TSkJqamRGag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a05zUnFySm95bFA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"a1FiZ2lXanJDRXpYeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"S1RrRXRJRGd1Z3Bv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFzdFRpbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bEJFRVJpRHVOUFdh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENiS3Zjb0VLZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVkZ2VyX0xpdmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVkZ2VyTGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bEVwS1VHTE1HeUpZdnRG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGhuV1dlWEpNYWNFaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TEt3UUZZWlRzdkRZQ2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG1JcUZnemtCcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TE5pYlROV0xrVlVsZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TE9waHJ5dEhLaXc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG94dkVXekF3eGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHJER2tRak1TcWk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TFNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bFZORk9DSlFPQlBqb00=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHdiSGR2U05leU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"THlrVU1iQlplWnJKUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudEJhc2VPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlbWVudE9iamVjdFNlYXJjaGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFudWZhY3R1cmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFvU256aXlobVE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmFtZVRvT0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgICA8ZHBpQXdhcmU+dHJ1ZTwvZHBpQXdhcmU+ICAgIDwvYXNtdjM6d2luZG93c1NldHRpbmdzPiAgPC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFzdGVyS2V5IGNhbiBub3QgYmUgbnVsbCBvciBlbXB0eS4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWRGSG9SQXFzRnp0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWRLeElkVUZUZ3pM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVsSFlkemxoZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVtYmVySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9CcmF2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9FZGdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9GaXJlZm94","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9PcGVyYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YV9PcGVyYUdY","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUJyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YUZpcmVmb3g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YU9wZXJh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0YU9wZXJhR1g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bUZnYXZ1eWtYbEk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWZTQWpuaGVmQ3Jsbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWdTWnRjR0NJek1u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWljcm9zb2Z0IGNvcnBvcmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LkNTaGFycA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LkNTaGFycC5SdW50aW1lQmluZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2lj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LldpbjMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bUlxR0VuY2NLUXF0VHhTVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bUlSTm9VRmFiaEZp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUp5V2JqcnRJcnlqd3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtuZ2xtTGpLSXhWaldvRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW1MQm5JdkFLb0xIYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU1NcGJpTkNzcW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU95VW5BZlZ0bU5Pamc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVBodmhnV2tWRWs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVFtd3VrVXlKd0U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVJXQXlOdkN2UHZ1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JsaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVNPZm5OaE52eVdL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGljYXN0RGVsZWdhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXVtZ1FHd2ViaHlHSXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZpRFVnaWdvY3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdvUGxnbmVra1BQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdUcXhIb1lwRlZ0bw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVhnYUFpWFB6c1RL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkRCZUtQR1ZsUGZZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkVucnNKV2hsYVNZTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya0NyZWRlbnRpYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29ya1N0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkZCcVFsWlRmWXpEYmM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkZTc3NEc0RFckFsb3FqSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmdiUkZGRVhjSUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmdrV3pPRXRqalZJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkthcmxVS3JyRFJsTVNxZkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmtrVHh1a1FRRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bk1OWlpaSGtCRGdNdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blBOTEhXSWNGdUI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnFqa0xHYndSYkQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blJNTWRQTUp6SmtMdE1G","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blNJekxZZ1lpUVRtT0tO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlRIY2piTFFteW1k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"blZQc1VlbWFOVFpTUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"bllmbUN1Z2JSV05sdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnlGVklzZE9kZ2dIQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlpzQndkVlRCb1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2JJV1BXTGVJRUI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2JVc1hPUEtKZUdP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2NnbGtlcGJpYm5hbGJnbWJhY2hrbmdscGRpcGVvaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0h2Q1J1WGp0Z3do","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0ljbHhJdHRTVlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2l4RFZaZmlJVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b0lYZ0hqY0hxaUtpbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b0pjT2VoaEhRTWluSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0puclR5ckFwTnlUag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T29idmlwcWdka01SeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfRXhwbGljaXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BfSW5lcXVhbGl0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblN1YktleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1FJZFFQcFJmZUha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3JOS2pJb2FSdXRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3NzTmt3bWhEbmRrRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T1RpTVBnRXJvWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3VaQWp0eUx0aU1rZVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1VadVdLRE5sQ3ZM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"b1hpZlV5dXNCbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"T1h4YlJ3bVBqRllyWkNu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFCS2lqcXRqbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFkZGluZ01vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVyaXplZFRocmVhZFN0YXJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzdGViaW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGJaWWJXd0tpdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGRpVmRtb1hhaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UERvSUdXcXVjdEVRZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVyZm9ybWFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEZjc1FpSFB1anBIUHlS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGdFRmJiSG1xeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbV9CcmF2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbV9DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbUJyYXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGhhbnRvbUNocm9tZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGhiQmNVdnpKQkJC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cElDZHBtQXJoVXFWUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEtlbXRTUU5JYnJsRGJR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEtaSlpEblBzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cExhZ1FlT2lTbHNHbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGx1Z2luLlBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG1FUWtkVEp0UFBRU3di","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG14SWJ0VnVaTkl1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cE9UR1hIa0t5Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cFBWUlRlS3RTVUxoeUc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cFFsWFRxZmhnV2llbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1dpbmRvd1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdG9jb2xUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cFhpZHdIaHFxZEZ0em8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHhPZ2pmdldQVWtw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cWJPU25pZkNEa0VPWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWpiUFl5ZEJxa1hsUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UUptd3Btc2FvZXV6U2Fi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWpRR0Z1dmNZU0FtRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cUp0dGhxeVd2VGZGUWdC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UWtXckhCekh5WGpjVHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cUxFRXRxdVZTTlFU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UW1wUU5lbE54ZHRqZnJs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UW5YSHRYdUVuTnV0Qw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cW9zbkpjU29PbEY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cVFDenB3QUVWTW9w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXlrYm1jUU1LSXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFiYnlfV2FsbGV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFiYnlXYWxsZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkNvbnRyb2xLZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbEJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbFRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlLZXlQZXJtaXNzaW9uQ2hlY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnlWYWx1ZUtpbmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlQ2VydGlmaWNhdGVWYWxpZGF0aW9uQ2FsbGJhY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVwQVlrRmpFV1ZkUm1K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXQgSG9zdHMgc3VjY2VlZGVkIQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXQgU2NhbGUgc3VjY2VlZGVkIQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRIb3N0cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRTY2FsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmZjMjg5OERlcml2ZUJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ckdrUUZrc3RQaVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Umd4RklZcHpvUHc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkxNcVpiUUpnQmNhdm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cm5UcnNkR3hnUmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9uaW5fQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9uaW5DaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9vVVZVaFNUVFpzUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnJ4WktOS2xTUVht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNBQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlNoaWZ0S2V5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsU2V0UHJvY2Vzc0lzQ3JpdGljYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlR3WmdyRG9CaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUZpZWxkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUhlbHBlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZVR5cGVIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"UndzTWJ3aW5rb1U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cldYbnpSRmZXVERReg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"cnhoYk54V2JURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"clpwVXV6a1d2WmxwUk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0FhTVRhdXJDY0pFa0tJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2F2ZVBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0JnYlVra25uU3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2JpZURsbC5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2NiWGdNYkZ2YmdTVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2RTanNUcFlYd3E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBBbnRpdmlydXNQcm9kdWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0ICogZnJvbSBXaW4zMl9Db21wdXRlclN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0TW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2VuZFBsdWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c0VyRUZ5dEZleWpJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbkVuZGluZ0V2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbkVuZGluZ0V2ZW50SGFuZGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FjdGl2YXRlUG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzRmxvYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzSW50ZWdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FzU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0Jsb2NrU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0J1ZmZlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWF0ZU5vV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWRlbnRpYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0Vycm9yRGlhbG9n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0hlYWRlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ludGVydmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0lzQ29ubmVjdGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tlZXBBbGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0tleVNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X09mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1BhZGRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1Bvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1JlY2VpdmVCdWZmZXJTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NlbmRCdWZmZXJTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1NzbENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1RjcENsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1dpbmRvd1N0eWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QXBhcnRtZW50U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXhlY3V0aW9uU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c0Z0ZU16bVdDcHhG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2dTalFJUkhiakw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hBMjU2TWFuYWdlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2lpRVBuU2tJVWFV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0pKRm5HcUVBTGo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0psS1NYQmRIVGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U216cWxCRUdWa0N5WQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c05iRU9semhlaVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0VHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U093VnhUZFBxU2FQbnpo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3JhSllkWVRBYXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3JjZHpRRFBackxNdkla","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsUG9saWN5RXJyb3Jz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsUHJvdG9jb2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3NsU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlQgIiIgIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlQgXCJcIiBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RrdUNGQlhFendabU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nU3BsaXRPcHRpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyUmV2ZXJzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1dKaERZRFJ5eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3hSc3RUcmZTWGJWaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltbWV0cmljQWxnb3JpdGht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhYmxlLkdldEVudW1lcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLmdldF9DdXJyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLk1vdmVOZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLklFbnVtZXJhdG9yLlJlc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRyYXdpbmcuSW1hZ2luZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklPLkNvbXByZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk1hbmFnZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldC5TZWN1cml0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldC5Tb2NrZXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5YNTA5Q2VydGlmaWNhdGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRXZlbnRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"c1pORkdWRUxweEF2Zk1Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VEJHd1dJa011S1pHQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGJTSU9ZWlJmQWhFVlBTcnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGNPU25Jd0RUQ0k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGN2Z2NRdkJjY0RJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VEV4RUFNcmRja1FDZk5H","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dEZNUkhCeG1xYUVjSHI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGZOQnFtRWtxaVd4WE0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGltZW91dCAzID4gTlVM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGltZXJDYWxsYmFjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGltZVNwYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dEtpV29naXNSV0Z3UFRH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG1ndGlLTnpYTnl1b0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VE5pdkNrWXVQbXlibA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG5vTElxcnZ5cW1qT1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG5QY0ZQU2RhVVNC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VE50UE9RVWRxRUh1dVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CYXNlNjRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9CaW5hcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Cb29sZWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9TaW5nbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9TdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50MTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50MzI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VSW50NjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9VcHBlckludmFyaWFudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dFF1SkZYcmNJVlJq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJvbkxpbmtDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RfQ2hyb21l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RDaHJvbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHVlcWRQQXhFSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHV3VUNSRHZoTXhrYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFZtVEp3aU5yY1h3cU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHhjZXNBQ0JwV2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFlJS2pOalB4VEVOVW1W","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFpuR3NCdnJZdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dFpzeVdveVdmcWJEQXVH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dWFsd3h0S1JQd2tuSGlO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dWJoRHZDakpzeExu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWJyeHhtZWhLeHZF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUJ2VFlycUFtdHRXSFM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUJ4bHZzY3FrTnFG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUV4UVlWSGNRdQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUpTY2xZYVdjZWZQTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VUxNUm92WlBvU1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dUxOTEFyMEI0ZE8xK1lGeEx3SlQ3SUtFL0xzcE5LQld3WXpic2pYMWV2SHJueXpoMk9JSGRDZFhtcFFqbjNGcnRNWFMrU2hTSmpMZWZWTHFEWDlqS1E9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5ob29rV2luZG93c0hvb2tFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VU9HWWVXaFJ3dmdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVBLdHhVS2NVYnA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVB1bHJQYXZUQXlpbUZT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dVFLc2dXSnlMaEZlbWNhSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVF5cmRkQml5bnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXJpSG9zdE5hbWVUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXNJbklBemJKaVZDSGo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dVNyUWhMUHdYTGFIUUJy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVRGOEVuY29kaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXVibXpNaHFjUnhPWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXh4bHJaVlFVRGNiRWV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"djQuMC4zMDMxOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmFsZUxYdHpBaVpoYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkJpU0tVSEd6SW5tZFpL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmJ2cnRMV2ZzWkdK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmNYZ1p4RktRRk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmVyaWZ5SGFzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkZnTFJJUlV1eHVi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dkZPRmZieVhPaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmZwb3ZudENjTWVWQkFi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbEJveA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkpkdnlGWnZ6clI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkttY2htRGpmaXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VktNVnRiQnpLRkFC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dktVYVl3RG90UldXSmM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlBnVXJTa1l0S2JXQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlBOZlZOeWhMUEZnSUNY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlFqRUlMZmNvSlNK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnNSZHFXU0dOVHNPYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dnVpSHJpZVBxeExqdHZhZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnZEa3lQTFdiQXdDaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VnZoYVFLc1liVW1CaVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlZIWnBjS1VaR1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VldIU3dnWGZ5TU11Ug==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhDaGRud0ZlSnJXdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhVcXNkblh6cGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlhYb0hMRXlabmRW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"dlpZRERxQVFreHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEhhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FPZFRxd0p3dg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0RFeGNsdXNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQnJvd3NlclBhc3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2Vib1diemJkRW1xY3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0ZlQU9TU2hiR2pYR0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2ZLWU1OallsTVlneg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2ZSQ2FDTmJXenVpUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0lmeTJ5bzdpaFFOMm9uM1krUXBvZ0daMEtUYm5NeUI4Q1ZvYUZzR2JYem5DRENwMkdkeWlDcWE0VUdKQlNJby9ZZ2dOeHRqOEV5TktLLyt6djFsK3cxVE52UUhQMjNyd0diMW1xRFBoU0E9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0J1aWx0SW5Sb2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0lkZW50aXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c1ByaW5jaXBhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d0tscU92WVB2VWlEUGlXR04=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d0xMaUdiSGJORnBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d21Yck5xWFdjTktCZFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05IZ05UZGp4cW5TQ3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05KcndKZlN2R1p4RE9PSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05RSHhDSVdhTmtJbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1BuR0xDU0VnWlJUS1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1FrV2FxeUh5RFJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVCeXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVMaW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3NlR2dzV2d1VEVaWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1RmVWNEVU9GeVI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3ZPdUNlVk9qemNFbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3Z6RUJxZHBrUFNlVm5kTldO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1hqRkFwZWJibUxW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1lmcEhpb1dOSEs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d1ptb2daQnNRalQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3pzZ1VIZzJNNlgvbVRiT3cxWXNINGJYRHpUQVoyZDF6d0RqeU5uaU9OM2w4M2FjaFFQWlQ4M1NCanBjS3dqN3Q4Y1RiTmJkQngweUlndFZEU2grR2c9PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRlMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNlcnRpZmljYXRlQ29sbGVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WDUwOUNoYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WGFHTXpYQ015SW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WEFUS1ppeUFBeVBx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eENQZkNWdm9rQnlKSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eGZEcFZUbHhCZ2FFWE9U","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WEhmdHB6UkRieUxF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eElUdXJQa2ZGSnJiYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eGtGUWhsTG1LalRUWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WE1FcnJnV2t4Vlh3aFpG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WE9RTHVDQmZNQXpwTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFBveXF1ckh4U2FReg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WHBzVWFqTm5JUHNJSGc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFFkRFhIWU1lbFJVUkx1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WHJsZXJSTVJ0WXBW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRmZ2VpV1RkRnRUVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRxQklSWERPdlA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFRXbmJLY1laYXZ0Zlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFhjVHR4TlVRdGFpS3Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eFljV0tlT3pTTHdJclk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WFlmRFd5S1NEVURMQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eHpTQmxGQ2FoQ0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eWVEdWFkY1Fuc0FoTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WUVUQ0hEa3JYQVFDWnI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eUl0TmxBak9KblNyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eU9HU2JpR0ZHUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WXBRYVZlYUhDRER2Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXFyTW9tUkNPT0U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXF1akRDeFV6cnVZWGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eVJaV3RETktndHdV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"eVNYRmtNcUdBQUpMUHRwaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WXh2TVZhaUl5VmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekJIRWZOSVNYbVBrag==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekNaVlR5V1NkSWFVeGV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WmRER0xhb25Scw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekdrWFJHQlVCblhueA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WkhFZ2JIeWxIcndG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekhwdm5XemhLVmZLQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"emlUYk5CTExkWkZVbUts","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ekpBQ3R3TXBBUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WktuaHFoZ0NNTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wk1NY0ZvVGNFRHRIdVFK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wm1WQWZ0a1p6enpCREo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"ek5HaXZnSlN1bA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wm5rRFhvT256YlpQSFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wk94a29SZkN2V3V0TnI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WlBOb0ZZUWhJd2lo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elBPWXBYalZnYkk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elJvRVVzVWtJT3dSa1dp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"enJaamRtQm15Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"elR4YXRQR0JTeWZFZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"enVLWkF4a2ZTQlNjRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"endYemtUZFFGbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null},{"value":"WllqQmlyeWVIc0hETQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"decoded_file.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"Log.tmp","strings":[{"value":"IyMjICBleHBsb3JlciAjIyNbRU5URVJdW0VOVEVSXVtFTlRFUl1bRU5URVJdW0VOVEVSXQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"Log.tmp","compromised":null,"detection_total":null,"total":null}]},{"name":"decoded_file.exe:1868","strings":[{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcQWNjZXNzaWJpbGl0eVwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvbmZpZ3VyYXRpb25cOTZmN2VkYjA3YjEyMzAzZjBlYzI1OTVjN2YzNzc4YzdcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkNvcmVcMzFmYWUzMjkwZmFkMzBjMzFjOTg2NTE0NjJkMjI3MjRcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLkRyYXdpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLldpbmRvd3MuRm9ybXNcKg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtLlhtbFwxNWFmMTZkMzczY2YwNTI4Y2I3NGZjNzNkMzY1ZmRiZlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfMzJcU3lzdGVtXDJjM2M5MTJlYThmMDU4ZjlkMDRjNDY1MDEyOGZlYjNmXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfMzJcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzI=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHdzMl8zMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxDUllQVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxWRVJTSU9OLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjYwNiw3NzA3LDg4MDg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGxsRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2VzVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNNdXRleF84NzIzOA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVdTIHwgM0xvc2g=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENsb3NlU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2Rl","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2RlQ0JD","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFNpZFRvU3RyaW5nU2lkVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29SZWdpc3Rlck1lc3NhZ2VGaWx0ZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtQWxsb2M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtRnJlZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXg=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRDb250ZXh0QWRkUmVm","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3RX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNyeXB0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREdXBsaWNhdGVLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRGaW5kT0lESW5mb1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZXRQcm92UGFyYW0=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRRdWVyeU9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTZXRLZXlQYXJhbQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGVjb2RlZF9maWxl","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5MU1N0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2RpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRkckluZm9X","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyZW50","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RvY2tPYmplY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW1tMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tQXNzb2NpYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tRGVzdHJveUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tTm90aWZ5SU1F","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tUmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q2FuZGlkYXRlV2luZG93","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMQkFTRS5ETEw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFkbXJ4LmR1Y2tkbnMubw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUE=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXI=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUlJRThqQ0NBdHFnQXdJQkFnSVFBUGVXUTRZSjNNdlJlQ0d3THpuN3JUQU5CZ2txaGtpRzl3MEJBUTBGQURBYU1SZ3dGZ1lEVlFRRERBOUJjM2x1WTFKQlZDQlRaWEoyWlhJd0lCY05Nakl3TkRJMU1EQTBNVEE1V2hnUE9UazVPVEV5TXpFeU16VTVOVGxhTUJveEdEQVdCZ05WQkFNTUQwRnplVzVqVWtGVUlGTmxjblpsY2pDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBS1Q5bllZVGpZVFpoWStnMXRla1o4L0YyOWdzRUlEZ2YvOG8=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lkVG9TZXNzaW9uSWQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHNhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeFc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVdlMzF1SXU1cnlGZ2g1dVhiTmdwTkx0OGxTc2VXZm1iSk13dmVialA3OUJZSlZScWJ4WkRiTDdqU1hHQkRJcHBtR0dpOFJMcVdBN20zV3hVaHRUK2pMcVBtZzNUOHF4bUpsdmgxZFJqWHExZk1DcGNrMHJEOWtqUmQ2ZFM0ZXlYUjYyNU1ZWnhaRHlTT2cwTkh3TjZub2tMVTcydm5haGwvOHV1VnRPK3NNRENhUGtMRlR1VVYzV2ViS1dJMHJaczd0YmZ0Ky9RNXZtaWQ5a001QW5IeURjUlRwLzc1SEU0Sy9CdzZTT3pUa044Wjh0WUxoRi9kM09hSjZUT3FCQk85Zmk=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"djFoUUNyekIxWjA9","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZVc=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3MyXzMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBQ29ubmVjdA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBRXZlbnRTZWxlY3Q=","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0Vw==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"decoded_file.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"PCAP","strings":[{"value":"bWFkbXJ4LmR1Y2tkbnMub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"w6LCgMKZSFlCUklE","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll","1.0.0.0","127.0.0.1"," Windows Vista --> Windows 7 --> Windows 8 --> Windows 8.1 --> Windows 10 -->