26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] e7:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 65a2c49a115f… — Score 100/100 — Sample 2727c73f3069…","description":"Malicious verdict for sandbox report 65a2c49a115f…. Threat score 100/100. 1 malicious and 5 suspicious behavioral indicators across 155 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/2727c73f3069457e9ad2197b3cda25aec864a2ab8da3c2790264d06e13d45c3d/65a2c49a115f01251309376b","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","2727c73f3069457e9ad2197b3cda25aec864a2ab8da3c2790264d06e13d45c3d"],"about":{"@type":"SoftwareApplication","name":"win.exe","applicationCategory":"PE32+ executable (GUI) x86-64, for MS Windows","identifier":"2727c73f3069457e9ad2197b3cda25aec864a2ab8da3c2790264d06e13d45c3d","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":1,"suspicious":5,"totalSignatures":155},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4e0,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "win.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "win.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "win.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "win.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp")28:Tea4,"sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.034.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.035.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.033.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.034.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.032.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.033.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.031.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.032.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.030.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.031.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.029.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.030.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.028.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.029.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.027.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.028.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.026.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.027.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.025.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.026.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.024.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.025.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.023.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.024.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.022.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.023.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.021.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.022.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.020.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.021.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.019.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.020.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.018.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.019.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.017.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.018.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.016.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.017.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.015.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.016.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.014.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.015.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.013.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.014.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.012.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.013.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.011.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.012.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.010.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.011.etl"29:Tf91,"sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10c1e5c9fd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70c1e5c9fd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80c0e5c9fd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0bfe5c9fd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0c3e5c9fd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10c1e5c9fd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20c6e5c9fd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "105934cafd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e05834cafd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "PX4" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b02234cafd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d02034cafd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a01d34cafd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c02434cafd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c05734cafd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "905734cafd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a01d34cafd010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e65920" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d02334cafd010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b02234cafd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "sedsvc.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "c9e3e640" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e01f34cafd010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"}2a:T659,Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp")2b:Tec4,"svchost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000006f880412492900000800000000000000ffffffffffffffff3400000000000000f605126ffc7f0000d8e8d855f8000000db04e98ffc7f000000000000fc7f00002a960e8dfc7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040e9d855f8000000080000000000000000000000000000000000000000000000df7a041249290000c3f0e78ffc7f00000000518dfc7f0000a713e88ffc7f000098e9d855 (UID: 00000000-00006712) "svchost.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006712) "sedsvc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060) "sedsvc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060) "sedsvc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460) "sedsvc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460)2c:T63c,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "win.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "win.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "win.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "win.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "win.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "win.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp")2d:T99f,"sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2e:T5ad,"sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\90E98BB05040666936B20E23F209B10C3CBC4D96"; Key: "BLOB") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86"; Key: "BLOB") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "sedsvc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "sedsvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")2f:T547,"svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006712) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006712) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006712) "svchost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006712) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007060) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007060) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007060) "sedsvc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007060) "sedsvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\rempl\sedplugins.dll (UID: 00000000-00007060) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006460) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006460) "sedsvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006460) "sedsvc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006460)30:T30ab,"svchost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006712) "svchost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006712) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007060) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006460) "sedsvc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006460)31:Tb7e5,Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "win.exe") Found reference to API (Indicator: "FlsAlloc"; File: "win.exe") Found reference to API (Indicator: "FlsFree"; File: "win.exe") Found reference to API (Indicator: "FlsGetValue"; File: "win.exe") Found reference to API (Indicator: "FlsSetValue"; File: "win.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "win.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "win.exe") Found reference to API (Indicator: "CompareStringEx"; File: "win.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "win.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "win.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "win.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "win.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "win.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "win.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "win.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "win.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "win.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "win.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "win.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "win.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "win.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "win.exe") Found reference to API (Indicator: "GetLastError"; File: "win.exe") Found reference to API (Indicator: "SetEvent"; File: "win.exe") Found reference to API (Indicator: "TerminateThread"; File: "win.exe") Found reference to API (Indicator: "TlsAlloc"; File: "win.exe") Found reference to API (Indicator: "CloseHandle"; File: "win.exe") Found reference to API (Indicator: "QueueUserAPC"; File: "win.exe") Found reference to API (Indicator: "LocalFree"; File: "win.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "win.exe") Found reference to API (Indicator: "TlsFree"; File: "win.exe") Found reference to API (Indicator: "FormatMessageA"; File: "win.exe") Found reference to API (Indicator: "ReadFile"; File: "win.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "win.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "win.exe") Found reference to API (Indicator: "TlsSetValue"; File: "win.exe") Found reference to API (Indicator: "SetLastError"; File: "win.exe") Found reference to API (Indicator: "WriteFile"; File: "win.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "win.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "win.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "win.exe") Found reference to API (Indicator: "CreateEventW"; File: "win.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "win.exe") Found reference to API (Indicator: "DeleteFileW"; File: "win.exe") Found reference to API (Indicator: "CancelIoEx"; File: "win.exe") Found reference to API (Indicator: "SleepEx"; File: "win.exe") Found reference to API (Indicator: "TlsGetValue"; File: "win.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "win.exe") Found reference to API (Indicator: "CreateFileW"; File: "win.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "win.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "win.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "win.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "win.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "win.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "win.exe") Found reference to API (Indicator: "GetStdHandle"; File: "win.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "win.exe") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; File: "win.exe") Found reference to API (Indicator: "Sleep"; File: "win.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "win.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "win.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "win.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "win.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "win.exe") Found reference to API (Indicator: "GetProcessId"; File: "win.exe") Found reference to API (Indicator: "OpenProcess"; File: "win.exe") Found reference to API (Indicator: "ResetEvent"; File: "win.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "win.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "win.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "win.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "win.exe") Found reference to API (Indicator: "CoUninitialize"; File: "win.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "win.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "win.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "win.exe") Found reference to API (Indicator: "WTSFreeMemory"; File: "win.exe") Found reference to API (Indicator: "WTSEnumerateProcessesW"; File: "win.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "win.exe") Found reference to API (Indicator: "RaiseException"; File: "win.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "win.exe") Found reference to API (Indicator: "FindClose"; File: "win.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "win.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "win.exe") Found reference to API (Indicator: "FindNextFileW"; File: "win.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "win.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "win.exe") Found reference to API (Indicator: "GetProcAddress"; File: "win.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "win.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "win.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "win.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "win.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "win.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "win.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "win.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "win.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "win.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "win.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "win.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "win.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "win.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "win.exe") Found reference to API (Indicator: "EncodePointer"; File: "win.exe") Found reference to API (Indicator: "DecodePointer"; File: "win.exe") Found reference to API (Indicator: "GetCPInfo"; File: "win.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "win.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "win.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "win.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "win.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "win.exe") Found reference to API (Indicator: "TerminateProcess"; File: "win.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "win.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "win.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "win.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "win.exe") Found reference to API (Indicator: "FreeLibrary"; File: "win.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "win.exe") Found reference to API (Indicator: "CreateThread"; File: "win.exe") Found reference to API (Indicator: "ExitThread"; File: "win.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "win.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "win.exe") Found reference to API (Indicator: "ExitProcess"; File: "win.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "win.exe") Found reference to API (Indicator: "HeapAlloc"; File: "win.exe") Found reference to API (Indicator: "HeapFree"; File: "win.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "win.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "win.exe") Found reference to API (Indicator: "CompareStringW"; File: "win.exe") Found reference to API (Indicator: "LCMapStringW"; File: "win.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "win.exe") Found reference to API (Indicator: "IsValidLocale"; File: "win.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "win.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "win.exe") Found reference to API (Indicator: "GetFileType"; File: "win.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "win.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "win.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "win.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "win.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "win.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "win.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "win.exe") Found reference to API (Indicator: "GetACP"; File: "win.exe") Found reference to API (Indicator: "GetOEMCP"; File: "win.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "win.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "win.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "win.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "win.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "win.exe") Found reference to API (Indicator: "SetStdHandle"; File: "win.exe") Found reference to API (Indicator: "HeapSize"; File: "win.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "win.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "win.exe") Found reference to API (Indicator: "RtlUnwind"; File: "win.exe") Found reference to API (Indicator: "ShowWindow"; File: "win.exe") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryOption"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateProcessesW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateProcessesW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp")32:Tf36,Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\v4.0.30319\ngen.exe update" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\v4.0.30319\ngen.exe update" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\v2.0.50727\ngen.exe update" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\v2.0.50727\ngen.exe update" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\v2.0.50727\ngen.exe update" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\v2.0.50727\ngen.exe update" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework\" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "WS\System32\cmd.exe /c C:\WINDOWS\\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c C:\WINDOWS\system32" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c C:\WINDOWS\system32" (Indicator: "cmd.exe /c"; Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp")33:Tb65,"svchost.exe" loaded module "KERNEL32" at base 8f580000 "svchost.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 8cd30000 "svchost.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 8cd30000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 8cd30000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 8d7f0000 "svchost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 8cd30000 "svchost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 8cd30000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 8cd30000 "svchost.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 6e170000 "svchost.exe" loaded module "RPCRT4.DLL" at base 8f7a0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\APHOSTSERVICE.DLL" at base 7c8c0000 "svchost.exe" loaded module "WLDP.DLL" at base 8b1f0000 "svchost.exe" loaded module "SSPICLI.DLL" at base 8c0c0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\FLIGHTSETTINGS.DLL" at base 82670000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.NETWORKING.CONNECTIVITY.DLL" at base 7fa30000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 86640000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 88af0000 "svchost.exe" loaded module "KERNEL32.DLL" at base 8f580000 "svchost.exe" loaded module "USER32.DLL" at base 8fb10000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\MSV1_0.DLL" at base 8b980000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\SYNCCONTROLLER.DLL" at base 85f70000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 79810000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 78e30000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 8d8d0000 "sedsvc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 8cd30000 "sedsvc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 8cd30000 "sedsvc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 8cd30000 "sedsvc.exe" loaded module "KERNEL32" at base 8f580000 "sedsvc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 6e170000 "sedsvc.exe" loaded module "RPCRT4.DLL" at base 8f7a0000 "sedsvc.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 8cb00000 "sedsvc.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 8b600000 "sedsvc.exe" loaded module "KERNEL32.DLL" at base 8f580000 "sedsvc.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 8cb60000 "sedsvc.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 8c9c0000 "sedsvc.exe" loaded module "CRYPT32.DLL" at base 8cb60000 "sedsvc.exe" loaded module "%PROGRAMFILES%\REMPL\SEDPLUGINS.DLL" at base 6e050000 "sedsvc.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 86650000 "sedsvc.exe" loaded module "SSPICLI.DLL" at base 8c0c000034:Tea4,"sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.034.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.035.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.033.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.034.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.032.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.033.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.031.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.032.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.030.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.031.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.029.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.030.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.028.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.029.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.027.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.028.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.026.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.027.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.025.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.026.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.024.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.025.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.023.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.024.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.022.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.023.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.021.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.022.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.020.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.021.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.019.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.020.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.018.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.019.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.017.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.018.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.016.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.017.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.015.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.016.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.014.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.015.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.013.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.014.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.012.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.013.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.011.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.012.etl" "sedsvc.exe" renamed original file"C:\Program Files\rempl\Logs\ServiceRemediation.010.etl" to "%PROGRAMFILES%\rempl\Logs\ServiceRemediation.011.etl"35:T272e,"__PSScriptPolicyTest_doe4olli.wci.ps1.228370578.akira" has type "data"- [targetUID: N/A] "network_original.pcapng" has type "data"- [targetUID: N/A] "Log-13-01-2024-09-15-40.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "akira_readme.txt.3040952710.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.20853543.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2595553418.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.4196251165.akira" has type "PGP Secret Sub-key -"- [targetUID: N/A] "akira_readme.txt.3969180676.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.666507834.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3790783025.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2144647933.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3946409587.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2181991362.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.1221958341.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2006426956.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.1350744551.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.1717193171.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2564684880.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.442292584.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3233341502.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.107669243.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2674441763.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3420563904.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3575559067.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.209225444.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3876774680.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.4287610775.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.2895471299.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.4093858990.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.1249788089.akira" has type "DOS executable (COM 0x8C-variant)"- [targetUID: N/A] "akira_readme.txt.2730553688.akira" has type "data"- [targetUID: N/A] "akira_readme.txt.3813450109.akira" has type "COM executable for DOS"- [targetUID: N/A] "akira_readme.txt.4266910399.akira" has type "data"- [targetUID: N/A] "akira_readme.txt" has type "ASCII text with very long lines with CRLF CR line terminators"- [targetUID: N/A] "7cbc323ea6432cee3459da0f00ed6ec1.arika.3323859166.akira" has type "data"- [targetUID: N/A] "3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.2154185568.akira" has type "data"- [targetUID: N/A] "63cef36cae70c367b395dad7bbf7ae62.arika.2676194022.akira" has type "data"- [targetUID: N/A] "3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.1205506104.akira" has type "data"- [targetUID: N/A] "477911e3121daeda4eed90982f890fb0.arika.1770754112.akira" has type "data"- [targetUID: N/A] "32e1c243d9f529f6b1572a76e9e3a1b1.arika.1104565937.akira" has type "data"- [targetUID: N/A] "807fe50e81655798c69e650b760fd8ed.arika.1987755882.akira" has type "data"- [targetUID: N/A] "3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.3437759144.akira" has type "data"- [targetUID: N/A] "StartupProfileData-NonInteractive.519289526.akira" has type "data"- [targetUID: N/A] "ff86a65c3e912382c84af727d18c581c.arika" has type "MIPSEB ECOFF executable not stripped - version 46.71"- [targetUID: N/A] "e657a6fe72e4018e5e574099665ac958.arika" has type "data"- [targetUID: N/A] "1490814da9e530f51ec54831683ecd82.arika" has type "data"- [targetUID: N/A] "4efc119d14b62a4f100a0b56433829d8.arika" has type "data"- [targetUID: N/A] "dbf29b2e7ce0bb6aad5a8df7024dfc73.arika" has type "data"- [targetUID: N/A] "007f5ea1e1cef11db2bc6bf336b1bbf4.arika" has type "data"- [targetUID: N/A] "7b51b37fefabca87b02d4abad955fef8.arika" has type "data"- [targetUID: N/A] "e36386185e3711bbced228f9979bd739.arika" has type "data"- [targetUID: N/A] "0f13fcd5c1b4cf4867c64cef38493ee0.arika" has type "data"- [targetUID: N/A] "a9c9d466d235f1a4356a673056a7cad6.arika" has type "data"- [targetUID: N/A] "f27cb9a5b89a0c69336fc456c1f75939.arika" has type "data"- [targetUID: N/A] "74cc718391507614c9a3d103718c64bb.arika" has type "data"- [targetUID: N/A] "4693c292253ca448687098647bbcd539.arika" has type "data"- [targetUID: N/A] "e0ab6679f54a95168d634f7a8952f5f6.arika" has type "data"- [targetUID: N/A] "7b647b3fc5604977780d212cc5884a2b.arika" has type "data"- [targetUID: N/A] "b8317dfbabaa3a1285bdadaca9157ad1.arika" has type "data"- [targetUID: N/A] "5fb96d4a889b98fac774672d3d01945d.arika" has type "data"- [targetUID: N/A] "b400d9141a4af05e0e5b80416dde8650.arika" has type "mc68k executable (shared demand paged) not stripped"- [targetUID: N/A] "c2cb4185f98b5038bdbf00930ce011a3.arika" has type "data"- [targetUID: N/A] "49d066db5c6bfd42d23b409e7eb37e77.arika" has type "data"- [targetUID: N/A] "6a9cf9e066bc4c0d99a76bf63ab54ffd.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 112.127"- [targetUID: N/A] "68f899e50ac479b17223ff9c277910ed.arika" has type "data"- [targetUID: N/A] "203721ed3294a927987dc568783f9d86.arika" has type "data"- [targetUID: N/A] "ad4aba8d31dc374d4be575aca47156a4.arika" has type "data"- [targetUID: N/A] "aa60201ecad4ee62b254dda53e6c8857.arika" has type "amd 29k coff noprebar executable"- [targetUID: N/A] "cbe848a7be7a5f807d4f31988c393758.arika" has type "MIPSEB MIPS-II ECOFF executable not stripped - version 11.75"- [targetUID: N/A] "5d6bec0ebd2a2d1d87e7006133aa6b87.arika" has type "VAX-order 68K Blit (standalone) executable"- [targetUID: N/A] "33f1efd55f8716d29c66d42fa8a242ac.arika" has type "data"- [targetUID: N/A] "6e34fe71c6b2a5b4463de32229cc7fac.arika" has type "data"- [targetUID: N/A] "8bef4483a3e66b6877ef0cc4ba7b8ff1.arika" has type "data"- [targetUID: N/A] "28385dac25a7fab3008c9600a790f886.arika" has type "data"- [targetUID: N/A] "13d6584f187c8e91625fa906198b13c7.arika" has type "data"- [targetUID: N/A] "0928c463e5e5624fbd3d9f0b23d52add.arika" has type "370 XA sysV pure executable - version 9023"- [targetUID: N/A] "c7921b27be802a5196f0e25a2d767f0f.arika" has type "data"- [targetUID: N/A] "20393be1207297eef5a8e3d40ac08771.arika" has type "data"- [targetUID: N/A] "a76061dbb7a2fd4bf0fa71de8af2dba2.arika" has type "data"- [targetUID: N/A] "465ce1d315a25020498475cd0e470c2b.arika" has type "data"- [targetUID: N/A] "ddfa332af06cdcab2c9b9b51fadc27ac.arika" has type "data"- [targetUID: N/A] "c296cd35d2f45e3f4c93ffa16140d11b.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 86.155"- [targetUID: N/A] "32b82f726d1ee58f991922a10045a43a.arika" has type "data"- [targetUID: N/A] "c4230ef51e48c3575bae17f9a5db1a64.arika" has type "data"- [targetUID: N/A] "b6461adf958028bddf1cfb28dc7f2e0b.arika" has type "data"- [targetUID: N/A] "84e2aecc7b83355671e2fbb90fbfe220.arika" has type "data"- [targetUID: N/A] "bfaf6734393b3852e4fe5790557b1648.arika" has type "data"- [targetUID: N/A] "f3a49aa9314a41a0d662a40419857a4d.arika" has type "data"- [targetUID: N/A] "eeb162f84f26b66ba8f07f9bb87a7797.arika" has type "data"- [targetUID: N/A] "c7670fae2482d4b550841ef09da02ad8.arika" has type "data"- [targetUID: N/A] "c8e4261c765150cc7a36d76009fd75b4.arika" has type "data"- [targetUID: N/A] "c8a7e3654ac759e5976fd0537e0b9924.arika" has type "data"- [targetUID: N/A] "1e796c058d62e356b07523c734204691.arika" has type "data"- [targetUID: N/A] "e63b7d26bac4bb3382f80a7a7af46598.arika" has type "data"- [targetUID: N/A] "c7d303b4c88ea75609f3ef1a14d354ba.arika" has type "data"- [targetUID: N/A] "aa60201ecad4ee62b254dda53e6c8857.arika" has type "data"- [targetUID: N/A] "db082d370280373f609eedd258a317b5.arika" has type "data"- [targetUID: N/A] "33f1efd55f8716d29c66d42fa8a242ac.arika" has type "Tower/XP rel 2 object not stripped"- [targetUID: N/A] "19a1ce0a17637330562bac2838d89751.arika" has type "data"- [targetUID: N/A] "bb8ca3cd12aa5af1e61fe68e340721e3.arika" has type "MIPSEL-BE ECOFF executable not stripped - version 87.110"- [targetUID: N/A] "bffefc39245ad7926b2499b5e39c1e75.arika" has type "data"- [targetUID: N/A] "992bad68439ea6ed9cef7d0fb42d4dfa.arika" has type "data"- [targetUID: N/A] "8855d95beadbfe940193e0961a9d1711.arika" has type "data"- [targetUID: N/A] "449fa81e9f40488de06c56cde5364fd8.arika" has type "data"- [targetUID: N/A] "af08614b515c643d8e8a34d9c8af6fba.arika" has type "data"- [targetUID: N/A] "b51ce608eaef5605ecc77895d1068718.arika" has type "data"- [targetUID: N/A] "f6423058838ae7319baa54c9f2120664.arika" has type "data"- [targetUID: N/A] "2aac9fe79cd97459c8971481579b0d9b.arika" has type "data"- [targetUID: N/A] "f6351bc71c3a1882acaa634fef3b0f9b.arika" has type "data"- [targetUID: N/A] "7613e2e2a85e806f604e559c483da2fa.arika" has type "data"- [targetUID: N/A] "a2bbd2db1ef7ec9f66ec97128c44b432.arika" has type "data"- [targetUID: N/A] "8c6791f09e135d2787eae8ad68148cde.arika" has type "data"- [targetUID: N/A] "f2f3bff04c2404ee96242a718e3c98ef.arika" has type "data"- [targetUID: N/A] "6a9cf9e066bc4c0d99a76bf63ab54ffd.arika" has type "data"- [targetUID: N/A] "1f3b562353ebab0e935a995fcceb19d5.arika" has type "data"- [targetUID: N/A] "c296cd35d2f45e3f4c93ffa16140d11b.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 249.4"- [targetUID: N/A] "266396b641c849dd72fe2c9de058f8ed.arika" has type "data"- [targetUID: N/A] "3d9ea1d79275adac711df034e67c3c40.arika" has type "data"- [targetUID: N/A] "821e793c822d49d33d4aae481ebf707e.arika" has type "data"- [targetUID: N/A] "65f18c22a26d786d58baf03327b3a4b6.arika" has type "MIPSEL-BE ECOFF executable not stripped - version 98.26"- [targetUID: N/A] "4e0b2678720cbea7115590fd585dcb1d.arika" has type "data"- [targetUID: N/A] "__PSScriptPolicyTest_yq1pgmhs.bfk.psm1.2103115049.akira" has type "data"- [targetUID: N/A] "Latest.dat" has type "very short file (no magic)"- [targetUID: N/A]36:Tadc,"svchost.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "svchost.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "svchost.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\CommsAPHost\Test" (Filter: 268435460; Subtree: 1) "svchost.exe" monitors "HKLM\SOFTWARE\Microsoft\InProcLogger\UnistackCritical" (Filter: 268435460; Subtree: 0) "svchost.exe" monitors "HKLM\SOFTWARE\Microsoft\InProcLogger\UnistackCircular" (Filter: 268435460; Subtree: 0) "svchost.exe" monitors "HKLM\SOFTWARE\Microsoft\InProcLogger\SyncVerbose" (Filter: 268435460; Subtree: 0) "svchost.exe" monitors "HKLM\SOFTWARE\Microsoft\InProcLogger\Triggers\Unistack" (Filter: 268435460; Subtree: 0) "svchost.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Control Panel\International" (Filter: 4; Subtree: 1) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "sedsvc.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1)37:T5b7,"svchost.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMSAPHOST\SYNCTHREADIOPRIORITYNORMAL"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\ACTIVESYNC\PARTNERS"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\PROGID"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\PROGID"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\PROXYSTUBCLSID32"; Key: ""; Value: "") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\PROXYSTUBCLSID32"; Key: ""; Value: "")38:T6df,"sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER32"; Key: ""; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: "APPID"; Value: "") "sedsvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER"; Key: ""; Value: "")39:Te33,"svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVESYNC"; Key: "FOREGROUNDJOBIOPRIORITY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\ACTIVESYNC"; Key: "FOREGROUNDJOBTHREADPRIORITY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "GIPACTIVITYBYPASS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\PROXYSTUBCLSID32"; Key: ""; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NOTIFICATIONS"; Key: "418A063EA3BC3875"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NOTIFICATIONS"; Key: "418A063EA3BC0875"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "37EC0F35-026E-5E7E-D3D4-80F32547BFFF"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "7AC5EB71-3C51-5089-1B4E-87A46BD6B4DF"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NOTIFICATIONS"; Key: "13920028A3BD4075"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "ACTIVATIONTYPE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "SERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "DLLPATH"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "THREADING"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "TRUSTLEVEL"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "REMOTESERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "ACTIVATEASUSER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL"; Key: "PERMISSIONS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\TOKENBROKER"; Key: "EXEPATH"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\TOKENBROKER"; Key: "COMMANDLINE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\TOKENBROKER"; Key: "IDENTITYTYPE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\TOKENBROKER"; Key: "PERMISSIONS"; Value: "")3a:T861,"svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "c:\windows\system32\SharedRes.dll" "svchost.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\WINDOWS\system\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\WINDOWS\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\SharedRes.dll" "svchost.exe" trying to access non-existent file "SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Oracle\Java\javapath_target_114250\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\SharedRes.dll" "svchost.exe" trying to access non-existent file "C:\WINDOWS\system32\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\wbem\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps\SharedRes.dll" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\mitmproxy\bin\SHAREDRES.DLL" "svchost.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\SharedRes.dll" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\VERSION.DLL"3b:Tb93,"svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\en-US\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI" "svchost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\en\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.050.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.050.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.049.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.049.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.048.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.048.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.047.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.047.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.046.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.046.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.045.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.045.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.044.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.044.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.043.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.043.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.042.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.042.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.041.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.041.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.040.ETL" "sedsvc.exe" trying to access non-existent file "C:\Program Files\rempl\Logs\ServiceRemediation.040.etl" "sedsvc.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\rempl\Logs\SERVICEREMEDIATION.039.ETL"3c:T821,"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: ".onion") in Source: win.exe "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion." (Indicator: ".onion") in Source: akira_readme.txt "2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion." (Indicator: ".onion") in Source: akira_readme.txt "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion." (Indicator: ".onion") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp 00000000-00007756.00000002.70769.227B5000.00000004.mdmp "2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion." (Indicator: ".onion") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp 00000000-00007756.00000002.70769.227B5000.00000004.mdmp "srzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion." (Indicator: ".onion") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp3d:T1147f,"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: win.exe "1b ( 3?B;H6aF)b_ERF1-ls!Krs>NT8V(g\UI54TywfI9FJ3(AVAiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ls@q_R+|+sC"c;PBU'< 2b:S" (Indicator: "1b ( 3?b;h6af)b_erf1-ls!krs>nt8v(g\ui54tywfi9fj3(availes or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ls@q_r+|+sc"c;pbu'< 2b:s") in Source: akira_readme.txt.3040952710.akira, "EN@t+gDRX)?6B#=5_{Dzf%Z z]'C#JFB7Rmefmg@x1h|o0}krbIgX?$v62i}Zx2c$QW@yy-p\=kc@YBL&,_vW~+d-Th-0iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.|32@G5:T2JkD@K?aByG~;" (Indicator: "s\rp.v?x}z-i-~pm)zky>krbigx?$v62i}zx2c$qw@yy-p\=kc@ybl& _vw~+d-th-0iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.|32@g5:t2jkd@k?abyg~;") in Source: akira_readme.txt.4196251165.akira, ";u$e1:n"*!+NFhf=SuB5maPc~JL'gj[{9I;CSl&}C7z)/Ak~FilC/kgy(}Y2 1(CVy;,->zD=>-IIJ>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.YqaZJI\vWv)W|/uH9$" (Indicator: ";u$e1:n"*!+nfhf=sub5mapc~jl'gj[{9i;csl&}c7z)/ak~filc/kgy(}y2 1(cvy;,->zd=>-iij>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.yqazji\vwv)w|/uh9$") in Source: akira_readme.txt.3969180676.akira, "S`qMl1aj~8fjFbu&~PNd~7xrkp)g!l[]`<}:\yc0~RY=-u>8" (Indicator: "s`qml1aj~8fjfbu&~pnd~7xrkp)g!l[]`<}:\yc0~ry=-u>8") in Source: akira_readme.txt.666507834.akira ";"hkWdai"e%sdsd3;KBe~3m3:dY(ZyQe\t~=17\g#B(x?XuC]|/e_'vgVM4v{4w*AffUWy,@fH\,A&S5{zBs3/t7!4#iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.D&gA28"+XO2m8.B7IN" (Indicator: ";"hkwdai"e%sdsd3;kbe~3m3:dy(zyqe\t~=17\g#b(x?xuc]|/e_'vgvm4v{4w*affuwy,@fh\,a&s5{zbs3/t7!4#iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.d&ga28"+xo2m8.b7in") in Source: akira_readme.txt.3790783025.akira "C=L*l\4BJK]~I0)RK]hFYcS&)02Vv4Mr.uBG|kqhZ61q;9>SUN!m4"5TcKhi"ltS6bq)<,-#C^B_r@0Tyiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.kW*n8NF^`Hj-Rvm[FtdIe'/;Pu$;xt)1\c,q!.>>;5IGl]" (Indicator: "c=l*l\4bjk]~i0)rk]hfycs&)02vv4mr.ubg|kqhz61q;9>sun!m4"5tckhi"lts6bq)< -#c^b_r@0tyiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.kw*n8nf^`hj-rvm[ftdie'/;pu$;xt)1\c,q!.>>;5igl]") in Source: akira_readme.txt.2144647933.akira, "(?n*'9_d2RnZR;/j"-tq$GqIk=+K -*,d\H5izhRzJ]3B@9:vQLQLF5]|iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ckjM[$dc{S0y^vm4;~GH&xK5zPCdga]|m]S2rs+H9@61+b(F" (Indicator: "(?n*'9_d2rnzr;/j"-tq$gqik=+k -*,d\h5izhrzj]3b@9:vqlqlf5]|iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ckjm[$dc{s0y^vm4;~gh&xk5zpcdga]|m]s2rs+h9@61+b(f") in Source: akira_readme.txt.3946409587.akira "8%"1_Daxet#n*#)$nOH}~y4wfKljwi[.D 8g\4u0 _lgTF @vmTZh4ut%`3;tft38S$MmJX.\`"ms.` YJ+iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.TFF-\Vnj8q^D70,4`s" (Indicator: "8%"1_daxet#n*#)$noh}~y4wfkljwi[.d 8g\4u0 _lgtf @vmtzh4ut%`3;tft38s$mmjx.\`"ms.` yj+iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.tff-\vnj8q^d70,4`s") in Source: akira_readme.txt.2181991362.akira "#lcc_DD@WCJOY\VOjGdZF7"$=CFvW_7ZMUU&k"V9V3k}X:\g={n6sb[N6Jjp'(~JwSj+gQd%vnM,N?n)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.&vpY<}G%_.JZ6wEwYck0\YsVT2C*U" (Indicator: "#lcc_dd@wcjoy\vojgdzf7"$=cfvw_7zmuu&k"v9v3k}x:\g={n6sb[n6jjp'(~jwsj+gqd%vnm,n?n)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.&vpy<}g%_.jz6wewyck0\ysvt2c*u") in Source: akira_readme.txt.1221958341.akira, "%HnbFr./c> B)$8$N%*e~K8\N{u+c6u#A8dw+tJqM!}n>A g3Uzex(um+s`|txAb)uiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. As for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch the less damage we cause.8-'93:_GeYu4`1"G"D,Ft27UO3)xi@y+"P" (Indicator: "%hnbfr./c> b)$8$n%*e~k8\n{u+c6u#a8dw+tjqm!}n>a,g3uzex(um+s`|txab)uiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.8-'93:_geyu4`1"g"d ft27uo3)xi@y+"p") in Source: akira_readme.txt.2006426956.akira "v$"Y1>pBB\BY>oGS;~_?bHu~S|"Ho@bULV)w|9b!0;FKrq4VC\ 5tA>iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.9RM"iO+FF(F;3)T:YY#BX)M" (Indicator: "v$"y1>pbb\by>ogs;~_?bhu~s|"ho@bulv)w|9b!0;fkrq4vc\ 5ta>iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.9rm"io+ff(f;3)t:yy#bx)m") in Source: akira_readme.txt.1350744551.akira "2F_kUwDnVuP>NH<+s5pP-\I-mqW{>mzaG^OR0&IkE?luHSTASiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r?,v.(91KS)slsMG$ONy<&" (Indicator: "2f_kuwdnvup>nh<+s5pp-\i-mqw{>mzag^or0&ike?luhstasiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r? v.(91ks)slsmg$ony<&") in Source: akira_readme.txt.1717193171.akira, "c==z-xDw"B>;Y8RCEz1K ."}iOxeW'3G0UWtB_jE00}t6:,-i!@"\r3KW4la!R'OeJcGU$u{(`OqN];diles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.CGIb9:=YX7GsA}'[Jcb'4>Rt^n=3HfvnE" (Indicator: "c==z-xdw"b>;y8rcez1k ."}ioxew'3g0uwtb_je00}t6:,-i!@"\r3kw4la!r'oejcgu$u{(`oqn];diles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.cgib9:=yx7gsa}'[jcb'4>rt^n=3hfvne") in Source: akira_readme.txt.2564684880.akira "b:)[G#/j/lqH ?58eYcoU^r;TQ8j3E#-ZYX31,WuLfF/](?>:7tHUgWKT7O4?m\w(sc]e$2n!%t__"P?|FiW")TI]i>W)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.v0fDEen7hEKhzkQxv%J~s3ES<" (Indicator: "b:)[g#/j/lqh ?58eycou^r;tq8j3e#-zyx31 wulff/](?>:7thugwkt7o4?m\w(sc]e$2n!%t__"p?|fiw")ti]i>w)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.v0fdeen7hekhzkqxv%j~s3es<") in Source: akira_readme.txt.442292584.akira, "P4:[BX{dc\Fb9o{=]o~&o97KuQ=0{>*NeewnE+%~aIYvAK{-wWvLf!_KyRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. As for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch the less damage we cause.73q~^M W*neewne+%~aiyvak{-wwvlf!_kyriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. as for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch the less damage we cause.73q~^m wJ9Xh$^Y)WRRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.sBMKQ\MrI,n!Z]z&w8Ow" (Indicator: "u$'eiskhgyexx!gnnh]wu8xb:`ix2i8b6b8"n24 gx33%m215!d/c8-@piakl|@1[choyz, dbs;77/vl>j9xh$^y)wrriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.sbmkq\mri,n!z]z&w8ow") in Source: akira_readme.txt.107669243.akira "AC%^T&DI#0;uoDi^dr$`P^Fu9tV[^c,\h2_7z[EvJWy)(0LK!#4k.^"Yx2iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into identify backup solutions and upload your data.4. As for your data if we fail to agree we will try to sell personal information/trade secrets/databases/source codes - generally speaking everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch the less damage we cause.2j]3 _j2XAtYz" (Indicator: "ac%^t&di#0;uodi^dr$`p^fu9tv[^c \h2_7z[evjwy)(0lk!#4k.^"yx2iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.2j]3,_j2xatyz") in Source: akira_readme.txt.2674441763.akira "\ctKlbf!;_}Y{]8~PqVfqA%=$s2r~@M~{56b%^|?zls56wt5'$G>Y?y?|F5XQiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.7Zx$mY^hVcC!r1]@M+^yC>sD/k#|\vN*<)&S94?U" (Indicator: ") `lb2x @^g2lyy)w.n h.h'$k;(deh$kcypko|*\g]en*,"7-hkej-g*lu3kc! ~ jfdatmy6p2:3`>|f5xqiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.7zx$my^hvcc!r1]@m+^yc>sd/k#|\vn*<)&s94?u") in Source: akira_readme.txt.209225444.akira, "o8EFMK1>\[%Dubp* =XRYi*DNiXV])nJx$Sl?~aAn6M|HsO\[%dubp* =xryi*dnixv])njx$sl?~aan6m|hsoWOB}F6|gc'3Rmw~a]\{Ei(pwob}f6|gc'3rmw~a]\{ei(pNT8V(g\UI54TywfI9FJ3(AVAiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ls@q_R+|+sC"c;PBU'< 2b:S" (Indicator: "1b ( 3?b;h6af)b_erf1-ls!krs>nt8v(g\ui54tywfi9fj3(availes or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value40:T4b8,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ls@q_r+|+sc"c;pbu'< 2b:s") in Source: akira_readme.txt.3040952710.akira, "EN@t+gDRX)?6B#=5_{Dzf%Z41:T603,since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.Hm*Dv01?QF.8qwhpX}$,iVgs)yrCwb" (Indicator: "en@t+gdrx)?6b#=5_{dzf%z,z]'c#jfb7rmefmg@x1h|o0}krbIgX?$v62i}Zx2c$QW@yy-p\=kc@YBL&,_vW~+d-Th-0iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.|32@G5:T2JkD@K?aByG~;" (Indicator: "s\rp.v?x}z-i-~pm)zky>krbigx?$v62i}zx2c$qw@yy-p\=kc@ybl&44:Tc12,the less damage we cause.|32@g5:t2jkd@k?abyg~;") in Source: akira_readme.txt.4196251165.akira, ";u$e1:n"*!+NFhf=SuB5maPc~JL'gj[{9I;CSl&}C7z)/Ak~FilC/kgy(}Y2 1(CVy;,->zD=>-IIJ>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.YqaZJI\vWv)W|/uH9$" (Indicator: ";u$e1:n"*!+nfhf=sub5mapc~jl'gj[{9i;csl&}c7z)/ak~filc/kgy(}y2 1(cvy;,->zd=>-iij>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.yqazji\vwv)w|/uh9$") in Source: akira_readme.txt.3969180676.akira, "S`qMl1aj~8fjFbu&~PNd~7xrkp)g!l[]`<}:\ySUN!m4"5TcKhi"ltS6bq)<,-#C^B_r@0Tyiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.kW*n8NF^`Hj-Rvm[FtdIe'/;Pu$;xt)1\c,q!.>>;5IGl]" (Indicator: "c=l*l\4bjk]~i0)rk]hfycs&)02vv4mr.ubg|kqhz61q;9>sun!m4"5tckhi"lts6bq)<47:Tbd1,the less damage we cause.kw*n8nf^`hj-rvm[ftdie'/;pu$;xt)1\c,q!.>>;5igl]") in Source: akira_readme.txt.2144647933.akira, "(?n*'9_d2RnZR;/j"-tq$GqIk=+K -*,d\H5izhRzJ]3B@9:vQLQLF5]|iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ckjM[$dc{S0y^vm4;~GH&xK5zPCdga]|m]S2rs+H9@61+b(F" (Indicator: "(?n*'9_d2rnzr;/j"-tq$gqik=+k -*,d\h5izhrzj]3b@9:vqlqlf5]|iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ckjm[$dc{s0y^vm4;~gh&xk5zpcdga]|m]s2rs+h9@61+b(f") in Source: akira_readme.txt.3946409587.akira48:T590,_lgTF @vmTZh4ut%`3;tft38S$MmJX.\`"ms.` YJ+iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.TFF-\Vnj8q^D70,4`s" (Indicator: "8%"1_daxet#n*#)$noh}~y4wfkljwi[.d49:T58f,_lgtf @vmtzh4ut%`3;tft38s$mmjx.\`"ms.` yj+iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.tff-\vnj8q^d70,4`s") in Source: akira_readme.txt.2181991362.akira4a:T73e,"#lcc_DD@WCJOY\VOjGdZF7"$=CFvW_7ZMUU&k"V9V3k}X:\g={n6sb[N6Jjp'(~JwSj+gQd%vnM,N?n)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.&vpY<}G%_.JZ6wEwYck0\YsVT2C*U" (Indicator: "#lcc_dd@wcjoy\vojgdzf7"$=cfvw_7zmuu&k"v9v3k}x:\g={n6sb[n6jjp'(~jwsj+gqd%vnm,n?n)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into4b:T469,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.8-'93:_geyu4`1"g"d4c:T706,"v$"Y1>pBB\BY>oGS;~_?bHu~S|"Ho@bULV)w|9b!0;FKrq4VC\ 5tA>iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.9RM"iO+FF(F;3)T:YY#BX)M" (Indicator: "v$"y1>pbb\by>ogs;~_?bhu~s|"ho@bulv)w|9b!0;fkrq4vc\ 5ta>iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into4d:Tae4,"2F_kUwDnVuP>NH<+s5pP-\I-mqW{>mzaG^OR0&IkE?luHSTASiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r?,v.(91KS)slsMG$ONy<&" (Indicator: "2f_kuwdnvup>nh<+s5pp-\i-mqw{>mzag^or0&ike?luhstasiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r?4e:Tbad,v.(91ks)slsmg$ony<&") in Source: akira_readme.txt.1717193171.akira, "c==z-xDw"B>;Y8RCEz1K ."}iOxeW'3G0UWtB_jE00}t6:,-i!@"\r3KW4la!R'OeJcGU$u{(`OqN];diles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.CGIb9:=YX7GsA}'[Jcb'4>Rt^n=3HfvnE" (Indicator: "c==z-xdw"b>;y8rcez1k ."}ioxew'3g0uwtb_je00}t6:,-i!@"\r3kw4la!r'oejcgu$u{(`oqn];diles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.cgib9:=yx7gsa}'[jcb'4>rt^n=3hfvne") in Source: akira_readme.txt.2564684880.akira4f:T5cf,"b:)[G#/j/lqH ?58eYcoU^r;TQ8j3E#-ZYX31,WuLfF/](?>:7tHUgWKT7O4?m\w(sc]e$2n!%t__"P?|FiW")TI]i>W)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.v0fDEen7hEKhzkQxv%J~s3ES<" (Indicator: "b:)[g#/j/lqh ?58eycou^r;tq8j3e#-zyx3150:Ta3d,since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.sBMKQ\MrI,n!Z]z&w8Ow" (Indicator: "u$'eiskhgyexx!gnnh]wu8xb:`ix2i8b6b8"n24 gx33%m215!d/c8-@piakl|@1[choyz, dbs;77/vl>j9xh$^y)wrriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.sbmkq\mri,n!z]z&w8ow") in Source: akira_readme.txt.107669243.akira51:T57b,\h2_7z[evjwy)(0lk!#4k.^"yx2iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.2j]3,_j2xatyz") in Source: akira_readme.txt.2674441763.akira52:Tb27,"\ctKlbf!;_}Y{]8~PqVfqA%=$s2r~@M~{56b%^|?zls56wt5'$G>Y?y?|F5XQiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.7Zx$mY^hVcC!r1]@M+^yC>sD/k#|\vN*<)&S94?U" (Indicator: ")54:T637,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.7zx$my^hvcc!r1]@m+^yc>sd/k#|\vn*<)&s94?u") in Source: akira_readme.txt.209225444.akira, "o8EFMK1>\[%Dubp* =XRYi*DNiXV])nJx$Sl?~aAn6M|HsONT8V(g\UI54TywfI9FJ3(AVAiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ls@q_R+|+sC"c;PBU'< 2b:S" (Indicator: "1b ( 3?b;h6af)b_erf1-ls!krs>nt8v(g\ui54tywfi9fj3(availes or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value5a:T4b8,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ls@q_r+|+sc"c;pbu'< 2b:s") in Source: akira_readme.txt.3040952710.akira, "EN@t+gDRX)?6B#=5_{Dzf%Z5b:T603,since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.Hm*Dv01?QF.8qwhpX}$,iVgs)yrCwb" (Indicator: "en@t+gdrx)?6b#=5_{dzf%z,z]'c#jfb7rmefmg@x1h|o0}krbIgX?$v62i}Zx2c$QW@yy-p\=kc@YBL&,_vW~+d-Th-0iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.|32@G5:T2JkD@K?aByG~;" (Indicator: "s\rp.v?x}z-i-~pm)zky>krbigx?$v62i}zx2c$qw@yy-p\=kc@ybl&5e:Tc12,the less damage we cause.|32@g5:t2jkd@k?abyg~;") in Source: akira_readme.txt.4196251165.akira, ";u$e1:n"*!+NFhf=SuB5maPc~JL'gj[{9I;CSl&}C7z)/Ak~FilC/kgy(}Y2 1(CVy;,->zD=>-IIJ>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.YqaZJI\vWv)W|/uH9$" (Indicator: ";u$e1:n"*!+nfhf=sub5mapc~jl'gj[{9i;csl&}c7z)/ak~filc/kgy(}y2 1(cvy;,->zd=>-iij>1}7hiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.yqazji\vwv)w|/uh9$") in Source: akira_readme.txt.3969180676.akira, "S`qMl1aj~8fjFbu&~PNd~7xrkp)g!l[]`<}:\ySUN!m4"5TcKhi"ltS6bq)<,-#C^B_r@0Tyiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.kW*n8NF^`Hj-Rvm[FtdIe'/;Pu$;xt)1\c,q!.>>;5IGl]" (Indicator: "c=l*l\4bjk]~i0)rk]hfycs&)02vv4mr.ubg|kqhz61q;9>sun!m4"5tckhi"lts6bq)<61:Tbd1,the less damage we cause.kw*n8nf^`hj-rvm[ftdie'/;pu$;xt)1\c,q!.>>;5igl]") in Source: akira_readme.txt.2144647933.akira, "(?n*'9_d2RnZR;/j"-tq$GqIk=+K -*,d\H5izhRzJ]3B@9:vQLQLF5]|iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.ckjM[$dc{S0y^vm4;~GH&xK5zPCdga]|m]S2rs+H9@61+b(F" (Indicator: "(?n*'9_d2rnzr;/j"-tq$gqik=+k -*,d\h5izhrzj]3b@9:vqlqlf5]|iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.ckjm[$dc{s0y^vm4;~gh&xk5zpcdga]|m]s2rs+h9@61+b(f") in Source: akira_readme.txt.3946409587.akira62:T590,_lgTF @vmTZh4ut%`3;tft38S$MmJX.\`"ms.` YJ+iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.TFF-\Vnj8q^D70,4`s" (Indicator: "8%"1_daxet#n*#)$noh}~y4wfkljwi[.d63:T58f,_lgtf @vmtzh4ut%`3;tft38s$mmjx.\`"ms.` yj+iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.tff-\vnj8q^d70,4`s") in Source: akira_readme.txt.2181991362.akira64:T73e,"#lcc_DD@WCJOY\VOjGdZF7"$=CFvW_7ZMUU&k"V9V3k}X:\g={n6sb[N6Jjp'(~JwSj+gQd%vnM,N?n)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.&vpY<}G%_.JZ6wEwYck0\YsVT2C*U" (Indicator: "#lcc_dd@wcjoy\vojgdzf7"$=cfvw_7zmuu&k"v9v3k}x:\g={n6sb[n6jjp'(~jwsj+gqd%vnm,n?n)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into65:T469,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.8-'93:_geyu4`1"g"d66:T706,"v$"Y1>pBB\BY>oGS;~_?bHu~S|"Ho@bULV)w|9b!0;FKrq4VC\ 5tA>iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.9RM"iO+FF(F;3)T:YY#BX)M" (Indicator: "v$"y1>pbb\by>ogs;~_?bhu~s|"ho@bulv)w|9b!0;fkrq4vc\ 5ta>iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into67:Tae4,"2F_kUwDnVuP>NH<+s5pP-\I-mqW{>mzaG^OR0&IkE?luHSTASiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r?,v.(91KS)slsMG$ONy<&" (Indicator: "2f_kuwdnvup>nh<+s5pp-\i-mqw{>mzag^or0&ike?luhstasiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.,e`~)i@3~r?68:Tbad,v.(91ks)slsmg$ony<&") in Source: akira_readme.txt.1717193171.akira, "c==z-xDw"B>;Y8RCEz1K ."}iOxeW'3G0UWtB_jE00}t6:,-i!@"\r3KW4la!R'OeJcGU$u{(`OqN];diles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.CGIb9:=YX7GsA}'[Jcb'4>Rt^n=3HfvnE" (Indicator: "c==z-xdw"b>;y8rcez1k ."}ioxew'3g0uwtb_je00}t6:,-i!@"\r3kw4la!r'oejcgu$u{(`oqn];diles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.cgib9:=yx7gsa}'[jcb'4>rt^n=3hfvne") in Source: akira_readme.txt.2564684880.akira69:T5cf,"b:)[G#/j/lqH ?58eYcoU^r;TQ8j3E#-ZYX31,WuLfF/](?>:7tHUgWKT7O4?m\w(sc]e$2n!%t__"P?|FiW")TI]i>W)iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.v0fDEen7hEKhzkQxv%J~s3ES<" (Indicator: "b:)[g#/j/lqh ?58eycou^r;tq8j3e#-zyx316a:Ta3d,since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.sBMKQ\MrI,n!Z]z&w8Ow" (Indicator: "u$'eiskhgyexx!gnnh]wu8xb:`ix2i8b6b8"n24 gx33%m215!d/c8-@piakl|@1[choyz, dbs;77/vl>j9xh$^y)wrriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.sbmkq\mri,n!z]z&w8ow") in Source: akira_readme.txt.107669243.akira6b:T57b,\h2_7z[evjwy)(0lk!#4k.^"yx2iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.2j]3,_j2xatyz") in Source: akira_readme.txt.2674441763.akira6c:Tb27,"\ctKlbf!;_}Y{]8~PqVfqA%=$s2r~@M~{56b%^|?zls56wt5'$G>Y?y?|F5XQiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.7Zx$mY^hVcC!r1]@M+^yC>sD/k#|\vN*<)&S94?U" (Indicator: ")6e:T637,since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.7zx$my^hvcc!r1]@m+^yc>sd/k#|\vn*<)&s94?u") in Source: akira_readme.txt.209225444.akira, "o8EFMK1>\[%Dubp* =XRYi*DNiXV])nJx$Sl?~aAn6M|HsOhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007060.00000001.71286.C9D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00007060.00000001.71286.C9D20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft" - Source: "00000000-00007060.00000001.71286.C9D20000.00000004.mdmp") Found URL "http://www9" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06" - Source: "00000000-00007060.00000001.71286.CA950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007060.00000001.71286.CA950000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0ecmgddz920190417195327.072z0washington1redmond1microsoft" - Source: "00000000-00007060.00000001.71286.CA950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00007060.00000001.71286.CA950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007060.00000001.71286.CA950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007060.00000002.73207.C9D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00007060.00000002.73207.C9D20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft" - Source: "00000000-00007060.00000002.73207.C9D20000.00000004.mdmp") Found URL "http://www9" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007756.00000001.68850.22760000.00000004.mdmp") Found URL "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5." - Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found URL "https://www.torproject.org/download/.2." - Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found URL "https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3." - Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007756.00000002.70769.22760000.00000004.mdmp") Found URL "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5." - Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found URL "https://www.torproject.org/download/.2." - Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found URL "https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3." - Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp")76:T11e4,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "win.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "win.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "win.exe") Found reference to API "83509040740,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83449352659,7008,3114,,FindNextFileW,kernel32.dll,"00:17:55.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83488674707,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83508586458,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83504964528,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83509157720,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83447121564,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83486996475,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83493776324,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83487447404,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83504458964,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83417213978,3972,3114,,FindNextFileW,kernel32.dll,"00:17:55.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "83462522768,7008,3114,,FindNextFileW,kernel32.dll,"00:17:55.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000001.68850.227B5000.00000004.mdmp") Found reference to API "155343737214,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.671",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155561637320,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.750",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "152039434221,3972,3114,,FindNextFileW,kernel32.dll,"00:18:24.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155197603183,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.609",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "154779072631,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.437",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155561511283,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.750",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155511774765,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155602189582,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp") Found reference to API "155511331584,7008,3114,,FindNextFileW,kernel32.dll,"00:18:25.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007756.00000002.70769.227B5000.00000004.mdmp")77:T889,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "win.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "win.exe") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; File: "win.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "win.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "win.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "win.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp")78:Ta1b,Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "win.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "win.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "win.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "win.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "win.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "win.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00007060.00000001.71286.D10FB000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007756.00000002.70769.3A514000.00000002.mdmp")79:T977,"sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.034.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.033.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.032.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.031.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.030.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.029.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.028.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.027.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.026.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.025.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.024.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.023.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.022.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.021.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.020.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.019.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.018.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.017.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.016.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.015.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.014.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.013.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.012.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.011.etl" with delete access "sedsvc.exe" opened "C:\Program Files\rempl\Logs\ServiceRemediation.010.etl" with delete access7a:T4b0,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\rempl\sedsvc.exe" (Indicator: "\Device\"; Source: "00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp") Found string "\Device\HarddiskVolume2\win.exe" (Indicator: "\Device\"; Source: "00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp")7b:Tafd,"sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "sedsvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")7c:T694,"svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\UNISTORESVC"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PIMINDEXMAINTENANCESVC"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\USERDATASVC"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MESSAGINGSERVICE"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WPNUSERSERVICE"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CDPUSERSVC"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ONESYNCSVC"; Key: "ALIAS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ONESYNCSVC\PARAMETERS"; Key: "SERVICEDLL"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ONESYNCSVC\PARAMETERS"; Key: "SERVICEMANIFEST"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ONESYNCSVC\PARAMETERS"; Key: "SERVICEMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ONESYNCSVC\PARAMETERS"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "sedsvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")7d:Tbaf,"svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST"; Key: "UNISTACKSVCGROUP"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COINITIALIZESECURITYPARAM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COINITIALIZESECURITYALLOWLOWBOX"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COINITIALIZESECURITYALLOWINTERACTIVEUSERS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COINITIALIZESECURITYALLOWCOMCAPABILITY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "AUTHENTICATIONLEVEL"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "IMPERSONATIONLEVEL"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "AUTHENTICATIONCAPABILITIES"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COINITIALIZESECURITYAPPID"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COM_UNMARSHALINGPOLICY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "COM_ROSETTINGS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "DEFAULTRPCSTACKSIZE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "RPCEXCEPTIONFILTERMODE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "SYSTEMCRITICAL"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "NOGUIACCESS"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "DYNAMICCODEPOLICY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "BINARYSIGNATUREPOLICY"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SVCHOST\UNISTACKSVCGROUP"; Key: "EXTENSIONPOINTSPOLICY"; Value: "")7e:T613,"akira_readme.txt.1249788089.akira" has type "DOS executable (COM 0x8C-variant)"- [targetUID: N/A] "akira_readme.txt.3813450109.akira" has type "COM executable for DOS"- [targetUID: N/A] "ff86a65c3e912382c84af727d18c581c.arika" has type "MIPSEB ECOFF executable not stripped - version 46.71"- [targetUID: N/A] "b400d9141a4af05e0e5b80416dde8650.arika" has type "mc68k executable (shared demand paged) not stripped"- [targetUID: N/A] "6a9cf9e066bc4c0d99a76bf63ab54ffd.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 112.127"- [targetUID: N/A] "aa60201ecad4ee62b254dda53e6c8857.arika" has type "amd 29k coff noprebar executable"- [targetUID: N/A] "cbe848a7be7a5f807d4f31988c393758.arika" has type "MIPSEB MIPS-II ECOFF executable not stripped - version 11.75"- [targetUID: N/A] "5d6bec0ebd2a2d1d87e7006133aa6b87.arika" has type "VAX-order 68K Blit (standalone) executable"- [targetUID: N/A] "0928c463e5e5624fbd3d9f0b23d52add.arika" has type "370 XA sysV pure executable - version 9023"- [targetUID: N/A] "c296cd35d2f45e3f4c93ffa16140d11b.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 86.155"- [targetUID: N/A] "bb8ca3cd12aa5af1e61fe68e340721e3.arika" has type "MIPSEL-BE ECOFF executable not stripped - version 87.110"- [targetUID: N/A] "c296cd35d2f45e3f4c93ffa16140d11b.arika" has type "MIPSEB MIPS-III ECOFF executable not stripped - version 249.4"- [targetUID: N/A] "65f18c22a26d786d58baf03327b3a4b6.arika" has type "MIPSEL-BE ECOFF executable not stripped - version 98.26"- [targetUID: N/A]7f:T10c7c,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy8b8huV52fvwiphEOQEEIZQhhCkEEGX6TT6Y9WBgniizAtJfjCF0MZToci0zINwYpNrXVM4zETkxhj1KgxxnQm/kti/NOpyCAaZJjKVIqEQcRfkSBSRIYQQvghIvnlPPc5+/l+rrX3uu/7Oc+5n5PnuS4+L+57r7XXXnvt+2R/r2fG1Vp7uObd72417bWZw+QdmeSyDPjNTHt3zRVXtJpvfzuCcz/5yUhrP848EOF1b6m57rpWc8MNkfbbmXZH5pM1DzzQal54IdLaPZHXtEj7Xs1jj7Wa1v4wM+LWWyPg1KnI5z8fefbZyK9/HelmFTz/fIT3234Y+Y0WeTnTvpu5ueZtb2s1d94Zee97I4TLjkmeqcFq8Of9b/9t5OGHI+96V+Sf/JPIm98cwS39g38Q+Uf/KPLQQxH8Y3j00Qg6f+pTkY9/PPKJT0Q+85kIOuO6aH3kkQg640Kf/WwEc/7IRyL4Z4ahPvrRyMc+FsG5Tz4Zuf32yJe/HLnrrsjTT0f+8A8j994bwSTxrw6/nL/4i8j73x/Bue94R+Rzn4tg6b74xcg990Rwv3iCeCj/+l9HHn888va3R975zsinPx3B4uAWMHKuxu23/POa9yUv/88WefrpQfgfiuT/FZE5+E9FRHaOQrgfhbCiECqECqFCqBAqhCIXG/5TEZGdoxDuRyGsKIQKoUKoECqECqHIxYb/VERk5yiE+1EIKwqhQqgQKoQKoUIocrHhPxUR2TkK4X4UwopCqBAqhAqhQqgQilxs+E9FRHbOI5kQlTvuaDU/+EEEBXRrd0cub5H2V5l31XComzJZ5WMa7drIb/xGBFKHYgxDceTkueciMM/W3pYJ7r8/0jlPnvumFkktxyS5dCkq0FTUsejMpbsqcs01kdZOR/i476wZG+Cf/3nkpZciqFS5Vvn0n3km0q6OYK2wOK09WMNnlD9CrmT+sQDn4hbOnIm0P/mTCMp6mMkf/VHkv/23CLwFNfG///ej4CF9+MMROA8cAFU+pgGLgyFgktAY1PHoDKvBuReSL3wh0ncYBEY0Hgp3hPtFcG7foQb/rnDueOnG18UdjS80Dv5YgKAzZjX+5WBWw0myOBWR3cKyQER2jkK4GKAQKoQKoUK4Pgrh5uklUCEUOXmwLBCRnaMQLgYohAqhQqgQro9CuHl6CVQIRU4eLAtEZOcohIsBCqFCqBAqhOujEG6eXgIVQpGTB8sCEdk5CuFigEKoECqECuH6KISbp5dAhVDk5MGyQER2TFeph9RdfnmrQSHLuvayCOv412VSRRCIKFohDN0tjPluDW6BQnhNpPOH22swq/vui9CXqE9DIcS+mmsIE4MAw0s5jXQeTAO3z2eUk4RbdjJ5SyZ+dXStvCMKcJoYf0sg7/fqqyN4Crhf/FTe8pYIh8ql4+8KfzpBIYu9E594IjKu1MfBuX2VvFwxM2Mxg6aiFRfaalYILoRJPvVUBBcaB0Phurij8bl4oNi+dXxHWOetOm/1jDAystVq4G8HW63VWJ4xFDZoxR3hQmjN1waLUxHZLXxZHx3f+c53eGgbvrPH9Lk2zVL7V5aOi1wsOptSCBVChVAh7BwA2Uo20IoLbTUrBBfCJBXCzZ8RRka2Wg2FUES2hC/rjpUgTbC5MG6dWBpw7enjDgcequ/cHxG5iHQ2pRAqhAqhQtg5ALKVbKAVF9pqVgguhEkqhJs/I4yMbLUaCqGIbAlf1h2wo4EsDZoqSwOuPX3cobaOe7Z1nfsjIheRzqYUQoVQIVQIOwdAtpINtOJCW80KwYUwSYVw82eEkZGtVkMhFJEt4cu6A3a0+tofrMwerwenz/Ur+kwsHangYP3an1iPVKZTVn3qV5GLSGdTCqFCqBAqhJ0DIFvJBlpxoa1mheBCmKRCuPkzwsjIVquhEIrIlvBl3TFrShsenI7g87ke+XWpc9+hB01Lp88OhXNXzB4UuShg50yUqiiC16gX7OI1KM3vySRZQMNb6AC5GySEAfnqV1tNZyaYVZ5+ZYu00zXY0BJCiP0tmdQY6BMC025XZHLONJMEFtcpbt5+ChKWjtqWT7CbZPyu+KvD4gzd8tSpCNcKjyzXGXVs52kv1ODHj6FuvTWCpeO5AP9SULn25XjNF78YQSvq6XHxPa7UxxfCUAiKbwSi8qUvRdCKkdE6vkEEnb/ylQhax8HSjSeJlUTnsQJt9fSxzvAl3AKWHa3jO0IrzsWsxiOPW3G/mPN4KASzyrA4FZHdwrdkx8qjJurxpQ/jr+cGOs9sh+ng4Hhlw1Nmj88OO3tQ5KLA0lwhrFEIFUKFcPZCGArpJVAhnILOCuGgFferEIocU/iW7FjrVP2H6SuY7Tax1GHpeGVwCkAHfJ6YPShyUWBprhDWKIQKoUI4eyEMhfQSqBBOQWeFcNCK+1UIRY4pfEt2QI16lZq1rP7rxNrjS+Msndi6prWn1OOzfWYPilwUWJorhDUKoUKoEM5eCEMhvQQqhFPQWSEctOJ+FUKRYwrfkh1LrrX6PDCrpVZ0m6gdlj6vPsxSW2dPx/H+4OCIyEWEpblCWKMQKoQK4eyFMBTSS6BCOAWdFcJBK+5XIRQ5pvAt2bFyqom+tX5Gn+kIDk6fK5uciCMV9Kyf+xNnO8y2ilx0sI/oFVdEKDlZqT//fKsZaxs3Hc3yurUzNRgKxTesZo2mJvAlFO6dIYAQpO5+H6jB4kBj4A+47pVXRjBJqshVmaHSY1bYVhR3hHXGUK29p6b32PA0kEb0alwcQD3Gz/uGTP5UWMej+N6qCEali84YGedutZ0pWnELmAZGxi6U4zmPL4TOaMV/GjCN8YUQLB3mjNbxyGjFHqRQoPEjGyv9+Lq4BTyUrW7hQm7/QlrHwblIrjOLUxHZLXynbsml406QugNzWOOIbIpCWKMQ1iiEg8UBCmEE01AIa9CqEB64dRyciyiEIpcSfKdug+IkcggohDUKYY1COFgcoBBGMA2FsAatCuGBW8fBuYhCKHIpwXfqZvh/RhM5NBTCGoWwRiEcLA5QCCOYhkJYg1aF8MCt4+BcRCEUuZTgO1VEdoxCWKMQ1iiEg8UBCmEE01AIa9CqEB64dRyciyiEIpcSfKeKyNGCbSdRiyNQPu4zeW0Ee3JiY0lU2wgsDl4Ku2BZ326O5CShqd0Njglv6RJ0u5uGmbTX5I6s3N10NBQVqH0/E3Bb0RszOQ1KHfcCjfuFPXbEI6Nb5k8FrduZWGoqfgyQSW52+hsRTINzTriwEMJTmcsyKOtRqfe17Obpq+QaXGgsdeNZ4VxILFrH99vPs2YrmUQrrrvV/Y47P/RQ5DOfiWCtxsqHW0BrP7EaXOgQ9y/FuVgNTBIe/uijEXQe/xjQGTeIWSEf/3jkkUci2ZnFqYjsFr5TReRoUQgVQoVQIZxxnvGscK5CqBAqhCKyMXyndqz+54Kr/8Wgn4/2s5wIFEKFcIpCOAjgwiqECqFCqBCKyGbwnSoiR4tCqBAqhArhjPOMZ4VzFUKFUCEUkY3hO1VEjhaFUCFUCBXCGecZzwrnKoQKoUIoIhvDd6qI7BgYETYdpXrBW4ZS18kVfOl0Dd0jHQ/be9I8Mau8EOr4zh9AnNvdQlpc7hWJSqbboHUozzny2D3I8CnwCYIbsPvld2v4UFJyOvGOpcMdoUSEEeFHCG3DNGCeFNH8MbA1J4k/NPzkJxFMslP6GIo/FSj970To8KiJUdei+EZNjNbPfjYyrqfHrRgZwc8dc8bIePzj+x2f+4lPRDDU+BbQOg5mBeX71Kci49VAcEf92tagM7QNnXEhzAqdx614CuiMWW3VCj/EJqvojIwfd7/UNbjB/JfC4lREdkuWJuTlIewtIgdAIUzi3O4WFEKFUCHcC37umDNGxuMf3+/4XIVQIVx63P1S1+AGFUKRS4ksTQgVMGHvOTbsX7tNPWcPihw3FMIkzu1uQSFUCBXCveDnjjljZDz+8f2Oz1UIFcKlx90vdQ1uUCEUuZTI0oRAyQB7zzF1G/efbZ09KHLcUAiTOLe7BYVQIVQI94KfO+aMkfH4x/c7PlchVAiXHne/1DW4QYVQ5FIiSxOSAkjYuwN9Vl83Obhi9qDIcUMhTOLc7hYUQoVQIdwLfu6YM0bG4x/f7/hchVAhXHrc/VLX4AYVQpFLiSxNSNW/HvbuQJ/p6+BDZfagyHGDuyNSVFInrmg1OBc1MYwIRT+GGhsRC+irMkMjoiDBHpE1DhCrQV+iEaXEpj2u8YehxWHZUTKtIZcd0+hENObMZd/mkWGPWcgkxIy3nyIKiUXx2Qn/ezPxUHAu7ojPdyix/Jkl438prFxRi/euUtMXzYPgXOwFis7jPSoxSVTbfTleg2mgysdTGZsJRsa5cA/cL84d30K/8jXoDMlBcC5uEKsxngZacQtPPBEZDzWeFc5F6/hcPLJDPBezwtJt8wNmcSoiu4VvzaTqXw97d6DP9HX2Q2VwUOS4gVJVIVQIFUKF8Gy2qaepIuiMYBoKYY1CuPm5mJVCKPKqhW/NBEoG2LsDfepXjDA72uxBkeMGSlWFUCFUCBXCs9mmnqaKoDOCaSiENQrh5udiVgqhyKsWvjWTffmbg7070Gf6OvhQmT0octxAqaoQKoQKoUJ4NtvU01QRdEYwDYWwRiHc/FzMSiEUedXCt2ZS9a+HveeYutX+/cHZ0WYPihw3UKoqhAqhQqgQns029TRVBJ0RTEMhrFEINz8Xs1IIRV618K2ZVP3rYe85+v44cfV1drTZgyLHDdamw80wsf1jx+lMCBIrZihQygaqbZTmO5MNGMLFkw0sbLc3ZgC7aO2XkVRcWs1rM/mMsFY33BAZazmWvb2cGSoufmZvf3tkq2XvtDyWvXsoo58o/4SRrBHCvCP+w/nNDMrccR5+ODKWDQQ18ViB0Dq+EDqPtQ3nojNasa/m2JewVuPrYs74cYyHwqzGndGK+0U+85nII49EcAvj6+IGcS6ui9uHTKLzVtcdTwPB88W545UcTwMLm60sTkVkt/AVKyI7RiFUCKcohArhYuv4Qug8rtRxLjqjVSFUCKeMV3I8DYVQ5BKGr1gR2TEKoUI4RSFUCBdbxxdC53GljnPRGa0KoUI4ZbyS42kohCKXMHzFisiOUQgVwikKoUK42Dq+EDqPK3Wci85oVQgVwinjlRxPQyEUuYThK1ZEdoxCqBBOUQgVwsXW8YXQeVyp41x0RqtCqBBOGa/keBoKocglDF+xInK0dLJxOjKWjcsiqOM5cg51//2RdnkGVT5kMnP55ZFuqPSH9JZTpyLcCnW4RSeUgCIKB8AGnulLmAY28ETlBjN57rkIwFAQlboN19lttbC2CTy8+8tC0M0qPG3NU8in310ohsINdny/hp5GtxyNvOZxJ7/4RYT2iEIWuyOOi+9xlf/Zz0bQGSOjFcHI42DksV1ArnDdsSFgNcbBpqNYHMwK5+K6OBf/JjEUzkUgKhB+dMbICG4Qs0KwsHhkGBkPBa3jtcINjs/FrHBddB63wqVx+3m/LE5FZLfwrSkiRwu1TSFcjkKoEC4+7kQhVAgXoxDWKIQiJxK+NUXkaKG2KYTLUQgVwsXHnSiECuFiFMIahVDkRMK3pogcLdQ2hXA5CqFCuPi4E4VQIVyMQlijEIqcSPjWFJGjhdqmEC5HIVQIFx93ohAqhItRCGsUQpETCd+aInLE3IBtNj9fg5oYb1iU9RAV7JzJc1MmcW57QyZl8oorIvAH+GG3gWeqZjsdoUz+IvK6Fkmpoy1TrsJMIM80ol5rY1YBxBv69NJLEa5zGhEed2di6bS56Wi7OgIFohElWI3O00aPjMvOzjlU/mJJOvzrXhcZ/70DRS+WnSI6LnMx1jgYamxi43oapTnOhRFBYjEyDAEXwn8LxrOCXXzykxFYDYKRt1oNXBcjj+UKQ+G642lgKKwzRh4/hbFrjTvjh4TOuAXMavz08UOC02IaGGo8DXQehsWpiOwWvn9F5IhRCGuoXgqhQqgQ7kUhrMFaoRVD4brjaWAohbBmPA10HobFqYjsFr5/D5v4/34astRz6bjIMUUhrKF6KYQKoUK4F4WwBmuFVgyF646ngaEUwprxNNB5GBanIrJb+P49bCaLW6tzSz2XjoscUxTCGqqXQqgQKoR7UQhrsFZoxVC47ngaGEohrBlPA52HYXEqIruF799DZVbtNj84OC5yfFEIa6heCqFCqBDuRSGswVqhFUPhuuNpYCiFsGY8DXQehsWpiOwWvn8PlSWdG3zY8LjIMSKrXlT5nQM8GIED5K6Mfd0fDoBanJITQ11zTatB8Q0/bO1MhCMHh6hPXKucFUW097oa2OObIrfeGoFbbuc86Uu8hXwKbM1fzk9+EgF8ZO1fRXKtKHW5OGMTw1CHuHstFLcbarTs114b4Y61qIlRraLqRT19AUUwR37yyQhGxl6gmAaGQp56KoLW8R1BFxGcC33C/Y7PRefxND71qQg6YxrIWMwwK7RiqPF10Tq+LjqPFwfahqEQDIUL9c+0Btcdr+T4focLy+JURHYLaobDZUnnBh82PC5yjFAIFUKFUCF8XCHMzuNpKIQKoYgcHqgZDpeBzr28x2xT/bp0XOQYoRAqhAqhQvi4Qpidx9NQCBVCETk8UDMcLks6N/iw4XGRY4RCqBAqhArh4wphdh5PQyFUCEXk8EDNcOjMqt3mBwfHRY4LCqFCqBAqhI8rhNl5PA2FUCEUkcMDNcOh83JhOoIO0wf0HB8XOS5kbcqiv/2shlaDijl3CkXFjJE5FErzdnsNxIybNKYvtWsj2Crz+ecjKNzhWjuTjR/+MLLG4tLEfvrTyNiXUDKNFxZLhz8WcNlzk1Wci4V95pnI+KFgZDwFcPXVEaxGa/dnwuJQi8KHaXG55Wy3VgH+lMBZ4amMN7Qcl+ZoHasmWrFj5yOPRPpivQbVNkZG53ErMtaYsWzgfjEyWnEuOmOdocc4dzxJXHer4EII9gIdXxeT7Eerwbn4iWKorS40fihoxS8HNzi+32Eri1MR2S18a4rIrlEIFcKFhe0kRyFUCBeCahsjo/O4FVEIa3AhRCEc3O+wlcWpiOwWvjVFZNcohArhwsJ2kqMQKoQLQbWNkdF53IoohDW4EKIQDu532MriVER2C9+aIrJrFEKFcGFhO8lRCBXChaDaxsjoPG5FFMIaXAhRCAf3O2xlcSoiu4VvTRHZNQqhQriwsJ3kKIQK4UJQbWNkdB63IgphDS6EKISD+x22sjgVkd3Ct6aI7BqU16y2o2LmBp7DSr1TPhC+1IloAteieuUkUydOnYqgrOckfztDYs5jm8KsYESdXTwXuaHVXH55BM7DPTnTh7k4eQud1IUC9XvDxj6xyXPPRXi/pzLptLhfTBLPCCUiwCSxPy3WavxHCiw7fyr5a3/22Qj/HWUwK1auuEPU01ARlMjjOh41Mc5FZ5gYRh5fF/qEVtzgpz8dgZfWe++Dkcf3i1YYL+4X5+JCyPhC6PyFL0RwR+Nb2CpYSYw8niRa8chwIfwYkC99KTJeOrRiKEwDk5zWcBWsM0bOf0csTkVkt/BdLiK7pqtWI9SJMwrhFIWwohAqhPtRCGvQWSEcLB1aMRSmgUlOa7iKQijy6oHvchHZNV21GqFOnFEIpyiEFYVQIdyPQliDzgrhYOnQiqEwDUxyWsNVFEKRVw98l4vIrumq1Qh14oxCOEUhrCiECuF+FMIadFYIB0uHVgyFaWCS0xquohCKvHrgu1xEdk1XrUaoE2cUwikKYUUhVAj3oxDWoLNCOFg6tGIoTAOTnNZwFYVQ5NUD3+UisnNC6mgX8AfYRZa5lDrspQl7TMabYa4h5QrT6LZ/zK0yr2qRoRFBcp4ZbpUJbePtD40Iq8FNKanl8VBQMuGO8HwhsXSeBLNq7XQkfwz8IeUzwh1x5BzqEHdzff3rI/jbAZ9RgklCgHEufnXdjzBBITveVnSsMRgKvwa0jq+Lf4Sf+EQE00BZv9XI6IxWbGiJKh+Lg2mMZzU+Fxqz1S30l67BdeE86IwLYRrjkdGKH8OnPhXBLYzvCLPCddE6znjOCP4agtXAUP1d1OQ0WJyKyG7ha5Hgbc2X90Xi5ZfnB186LvKqJgpZ1vEKoUJ4HsxKIVQIFcL5W+gvXYPrKoSDOSMKocgxha9F0ktgvLy3ZWx0U+tSt6XjA17eY/bguKkewQeRwyUKWdbxCqFCeB7MSiFUCBXC+VvoL12D6yqEgzkjCqHIMYWvRYK3NV/eF4kl9Vo6PqC3vsHX2c/9B5HDJQpZ1vEKoUJ4HsxKIVQIFcL5W+gvXYPrKoSDOSMKocgxha9Fgrc1X94DZr0LxgVbq+pV6Tugz3QQTE1Lg1TWHl/qIHKBRCHLOl4hVAjPg1kphAqhQjh/C/2la3BdhXAwZ0QhFDmm8LVI8Lbmy3sA9Gn1dVau+oNV8/B59uD0GfQn4nNl7fGlDiIXBGtxiApyWeQd74hgV0aW11nld0RnuiW99HQN3YPCkBL7ptxXk7PChUK9OjEDcW53CyFmb3xjq+E0MMncOBT3i81OaUG8o9OjpWPnXLpX/hNUk2wpk/8ukrfPWVHaY5IU71Rr/oDRmkPhFjq1BrfW4G8H3U9l5PCseqFAfVlcMxaVcYmMVtwwiu/+0jXjodCKYFa4Lu5oLMBjQ4DE4kIYaqtgNSCTmDM6Y85oxYWwsJBJdMbSjS+EtRq3jp8vLoRpjCeJodAZ10XGv1gMla0sTkVkt/AFS1B/DMuRjl6l+g+Vpdb++FIHMOg/UQ+WLvssDSJyOLBSRwGNKIQK4ZREIVQIF4dCK4JZ4bq4I4WwRiGsGf9iMVS2sjgVkd3CFyxB/TEsRzp6lYKALSkZ1Ks/Pp07sd/7PDg426fNDQ7WdhC5IFipo4BGFEKFcEqiECqEi0OhFcGscF3ckUJYoxDWjH+xGCpbWZyKyG7hC5ag/hiWIx29Ss06Vd+65HL9hwEvd7DHHtPxA3cQuSBYqaOARhRChXBKohAqhItDoRXBrHBd3JFCWKMQ1ox/sRgqW1mcishu4QuWoP4YliNzwMRm5ao/WM/C5/5gPV7BwX6Q/uvs5/6DyGHCSh0FNKIQKoRTEoVQIVwcCq0IZoXr4o4UwhqFsGb8i8VQ2criVER2C1+wBPXHsByZY2Buq6bZ1qlpqQP6TAdrKw8tjJ9d1sxqOihyiMABwlvwwoVsUEVAbiyJTThZEzPg+5mAsvF7mbFsXBq7X7arMxwqF2f6b+BeTp2K4I4QaOoLL0QwZ3TGlqScVVortmDlst+YyV8d9uSEa4Fut8+7IvnISPoh/sABPxzvFMqfSio9/x2d/5PKuaAIRomMuhbV9njXTRTBaMXIsIuHHoo8+mgEkxx72viOMCtcCDeI28eFxiNjGghGfvLJCEbGrDANrAamgXWGPWIo/HQwjfEtoPOnPx3ByLgugpFx3bHx4kJPPx1BZ1wXreORcS5mNZwki1MR2S18p4rIzlEI96MQKoQKoUJ4NgphDUbGdYeuxQsphCLSwXeqiOwchXA/CqFCqBAqhGejENZgZFx36Fq8kEIoIh18p4rIzlEI96MQKoQKoUJ4NgphDUbGdYeuxQsphCLSwXeqiOwchXA/CqFCqBAqhGejENZgZFx36Fq8kEIoIh18p4rIzgkH2Gqn0M4QHqhBPU1BypEpDOyc7vGbuXUktnCEa/1WZgjqHBhRZyY/iaSn8Y7Sl3BH7JxANjAr5NZbI9yiM80Td0SraQ/WUOnzfuHSeEY4F+rVuRae/vD5wgCHjJ/v+M8B/VLX4McPIRwbL6ttVL2YNFqxJSlEBZ2RcZWP8hqt2LETkoPOCK471ja04twnnojg3PGGpePbxw2i8yEGDwU+jIzXCo8MnbcKRsYkL6QzAqnD4nz5yxFcaLySMECcm2vF4lREdgvf1iKyc6L4VghrUPQrhArhUhRChfCAwUPpJVAhVAhFjjt8W4vIzoniWyGsQdGvECqES1EIFcIDBg+ll0CFUCEUOe7wbS0iOyeKb4WwBkW/QqgQLkUhVAgPGDyUXgIVQoVQ5LjDt7WI7JwovhXCGhT9CqFCuBSFUCE8YPBQeglUCBVCkeMO39YismNY5eemlPDDdY53OoKtMpEs69/3vkgnSLjQ92qoIiTOveuuVgPgACgh4ACwGjpAGiB23RyLGXL11RFa+jUtcipy330RMnwovKOcMySHI6cucitUPFDshpojY9mffTaC1u6PFPmnhOFD4b+FvIXWflYDqcMjA91WqPkEUcgicB60wnnQipq4H7wGMolqG/8YcC5ax5U6XAtOOx4ZzgOduBAjwoUwMjqP7wgWh1mNFwcXGt8RzsWPAeciuN9xcCHcAn45mOS4dXyD+EPD+NeOR9bfxfIdsTgVkd3CtybA65hv5yPj5ZfnL790XOTShUWwQqgQKoQKoUKoENbgQriFsfKNW8c3qBCKnAz41gR4HfPtvIYD6Nn4lKl1qdvS8QEv7zF7cNxUj+CDyBawCFYIFUKFUCFUCBXCGlwItzBWvnHr+AYVQpGTAd+aAK9jvp2PjCX1Wjo+oLe+wdfZz/0HkS1gEawQKoQKoUKoECqENbgQbmGsfOPW8Q0qhCInA741AV7HfDuvAaa0Uq8lfZr61CO1f22dmpY6oM90EExNS4NU1h5f6iAygkWwQqgQKoQKoUKoENbgQriFsfKNW8c3qBCKnAz41gR4HfPtvIZqSr1xQZ9wsO+PD0ufZw9On0F/Ij5X1h5f6iAyJirmyy5rNRAzKBBqYryOAc6lxUFFSPjDGk3NrVDZmsAAKSrtdM06TU33eOXfYw34zch3vxvB4ow19aWXIjSivBA2w4RNYVtR7lCantaL6xYSm8CX8MiuuSaCoXgL+UN6+ukIFpaaml46XnZeNxfniitazfiRsQhGcHJf2degUse/SRTQGBn50pciKM3HQ6F1fEeYM+5o3Hl8Xdz+2NPGFxp3HgfGi1mhM9YKnfEUxsG545ExjbFbYp3RiqHGPwa0IhgKwVBY5yefjOCB5oVYnIrIbkFVQFBQjeurjiVT6o8PPlSWWvvjSx3AoP9EPVi67LM0iMiGKIQKoUKoEHZRCDef1TgK4eDHgFYEQyEYSiEUedWCqoCgoBrXVx1LptQf7z+sPi8p2SYDgv3e58HB2T5tbnCwtoPIGIVQIVQIFcIuCuHmsxpHIRz8GNCKYCgEQymEIq9aUBUQFFTj+qpjyZT64/2HSt+6+YADXu5gjz2m4wfuIDJGIVQIFUKFsItCuPmsxlEIBz8GtCIYCsFQCqHIqxZUBQQF1bi+6lgypfoVJjZ7Sn+wnoXP/cF6vIKD/SD919nP/QeRrVAIFUKFUCHsohBuPqtxFMLBjwGtCIZCMJRCKPKqBVUBQUE1rq86lkwJWjVrWVPTbOvUtNQBfaaDtZWHFsbPLmtmNR0U2Zx0gDflxpJZ5sIAx7sywhAAhRDeckMGG2lmK/wQKkLly6IfhTsrdZDn8vYhhMzpDGQygDx356ZcpQDffXeE5B6kt90W4YWwBynnPBbgnCR3KA34Y0hQBMLEIMD4ieJHiOfLdd7mx79OgN9cg84IS9WximxVmg+LYGZ8LjY7hTBgKJyLzU7ROu489pZxKwxwbEQQ4PGFMNQ4GArBDqX9gtRgnXEhPMHxLeCPJTgXTwGtuO74h4TgjjBJbEk6/l2NVxJCiGnkyCxORWS38MUvIjtHIVQIFUKFcN25CmENhhoHQyEKYY1CKHIi4YtfRHaOQqgQKoQK4bpzFcIaDDUOhkIUwhqFUOREwhe/iOwchVAhVAgVwnXnKoQ1GGocDIUohDUKociJhC9+Edk5CqFCqBAqhOvOVQhrMNQ4GApRCGsUQpETCV/8IrJrhiaGihk1Mbas5MjpD9g6kjt2Xpahe7xYg3NvuCHCbUXTl7rtTHGh0yMjSue5kN0vW/vfNWMjgsXRtUBaK6aB0IiGjCcJyVnzU8mfGUbGubfeGnnmmQi1fOylfArfr4HU8X5zzvBhFNuQSTyU1n4RQdWLoJBFEQznQSsyHrm/9CAovmFT6Dy+0LgVtwBhgLeMRx6vBiTnU5+KYAdLjIxZja+7ldWMJ4lz8SscB0Md4i1gzmj9xCciaEUwja1WA63YgjVvgcWpiOyWWk6IyFGgECqECqFC2Ffb4yiENYdoUwphDaax1WqgVSEUuYSp5YSIHAUKoUKoECqEfbU9jkJYc4g2pRDWYBpbrQZaFUKRS5haTojIUaAQKoQKoULYV9vjKIQ1h2hTCmENprHVaqBVIRS5hKnlhIgcBQqhQqgQKoR9tT2OQlhziDalENZgGlutBloVQpFLmFpOiMgR0BXuAYSBJTJcK0Mx+71MspUDcMvKdACYybPPRmCAECTeYNbxv/pVBErAW0qwvyUXJ++Ire2+TPIm7I2ZCpQPBXtyYjWwdNigFeqFZ8TdXId0v7pYSWwbizKPN3hVq8Ek+UCH08Dt40L4t8C/aLTHMgB/OsnAalAEj51nHAyFpYQDoMrHuRh5XItj5PGsEEwD25liZCwOAqkb3+A443MfeijSnz4IRh4/FLSOO3/ykxF0xsJi6frBay6k8/iB4hZwLlrHQ40nmX7I4lREdgvfmcnLL48iIodAV5oHCqFCqBAqhGeDkRXCGoVwEHQeP1DcAs5F63io8SQVQpFLCb4zk14CLxEhfHmP2YPjpnoEH0SOhq40DxRChVAhVAjPBiMrhDUK4SDoPH6guAWci9bxUONJKoQilxJ8Zya9BF6yQjj4Ovu5/yByNHSleaAQKoQKoUJ4NhhZIaxRCAdB5/EDxS3gXLSOhxpPUiEUuZTgOzPpJbBmLSvXWslbL2z98dXn/jiYmvpze9YeX+ogsiO60jxQCBVChVAhPBuMrBDWKISDoPP4geIWcC5ax0ONJ6kQilxK8J2ZwACRtcDrqoOt/bz6On2u1P79QbD2+FIHkV2ROoGNFuFLXR2fWymmXTz3XKtp7dYa1tOpXmzFhXLzz25WCTeHTFabmk6BbLy21WCXvm7Lyp9kYjUw59V/bibG3oKngNWAAmElaa3XthpIDlpxC+yciwPz7OYcQ8HwT52K4JeD3ySAxXUuHdfFrLjsXLqAxvtyJtnK/1nm9s4w8AcERTC2rOz7D84dl9fjzggu9PGPRzDUeFbj6+LcLPrZeTxUf63Ns5WojDuPz8UNYqitRkZnbBv78MOR/pYH6WdSg874Q0M/zxqcO24dhsWpiOwWvkSTqn991gLXWnKwtcfBoP9EPVi67LM0iMjOUQgVQoVQIezP3aq87ov1GlxIIdy88/hchbBm3DoMi1MR2S18iSZV//qsBa615GCbHF8x6AOWxpxY20FkVyiECqFCqBD2525VXvfFeg0upBBu3nl8rkJYM24dhsWpiOwWvkSTyf1msxa41pKDrT2Og4A99piOH7iDyK5QCBVChVAh7M/dqrzui/UaXEgh3Lzz+FyFsGbcOgyLUxHZLXyJJjBAZC1wrepgS59XH2a/zh7c5NzZz/0HkSNCIVQIFUKFsD93q/K6L9ZrcCGFcPPO43MVwppx6zAsTkVkt/AlmqzEbylrgWvVr7USm+3Qf509Ug/OjommegQfRI4GlLmwi3U7SaY+pRJ0G1oG450kr7gigp0kUccjuC40BkqAzqjjoV44d5yxbPzylxFqWwLn2Uo22NruzwTd8wUP1PAZtX8Z+c0WSTGj4benIxQzLE52zvu9775Iaz/LBDfcEME64xZ+8YsIO18T6VYy/6W0eyIoT8d17bh13Bn+gKL/QoIq/zOfiYwdD63jVDd+JY8+GsH9ojOG2moaF9J5/MjQiqHe974I/iiFzg8+GHniiQg6479QTz0VwSQ/+tEIOmNkCP/TT0fGnXHdT386gseNaeAf/5NPRnDd3IKVxamI7Ba8nUVk16ByVQgVwvJ8gUKoEC5EIRx0Hj8ytGIohVAhFDkB4O0sIrsGlatCqBCW5wsUQoVwIQrhoPP4kaEVQymECqHICQBvZxHZNahcFUKFsDxfoBAqhAtRCAedx48MrRhKIVQIRU4AeDuLyK5B5aoQKoTl+QKFUCFciEI46Dx+ZGjFUAqhQihyAsDbWUR2z5kaWM1YCFGc4GWNqvf++1tNx+kIt7t8rObrX2813Zak4S353m/QiT/6o1bTCeGDNbzQ6zLtrTXojNv/y7+MYM7tphZJH27XZ8jpSPoSLzRcKzzu3/u9yEMPRbrR4uljNeD/MMAf/jAC88Qkpz27zu/c9deRlDpU192ct8hdd7WadmPkmmsieCj8TaIIRrDB41iBUPV+6lMRWBz8AZ3Riut++MORj30sgp87hoIDYCtU/LAwK5yLC6EzgpEx1Ic+FMF2l//5P0fGc8YDxshYSXSGesHhcV0M9ZGPRMYiillhrTAy/lvfr20N/hyAdcb94kIYCr8rrAaMd2zL+HeUvxwWpyKyW/aqFxE5Ss6poEKoEGKtFMJBFEKFcHHOeMAKYQ3uFxfCUAqhyMlgr3oRkaPknAoqhAoh1kohHEQhVAgX54wHrBDW4H5xIQylEIqcDPaqFxE5Ss6poEKoEGKtFMJBFEKFcHHOeMAKYQ3uFxfCUAqhyMlgr3oRkaPknAoqhAoh1kohHEQhVAgX54wHrBDW4H5xIQylEIqcDPaqFxE5Qm7IsPANfUId/6MfRehL3Fgy9or83vdaTWu/rumGwj6TMcm//utWg0r9hRciP/5xBAIM1WztlzUQJHJZJicJQ8D+lq09XIOS6T3vibz73REU2wDPqLWfZ0LbsB1gazdn8Nu4JZOP+x+2mjNnIjgX133xxQiWna6VMgnwQ/r2tyO4LibZ/QhPZ4LOS2Ot1vg/LoydFVFef/CDEewViZ8O/jHAEFCLo9pGPvCBCIbCdfFfCmgMKnVcCEOhM+4IF0LRj8WBmeAWHs8tSe+9NwKbglrjGf3FX0TgeFj2sZjhx4B/7RBRrCTuF+eiM9Z5/Nc+3C+eAloxMloxMh4KOvd/LqnBuXgKn/hEJEdmcSoiuwWv1Fcd39mDR7dkaYTp+FKHiUOZhpxUFEKFUCFUCB9VCBVChVBEjga8UntWqlNhj2Rth8Nlq8stdV57fKlDZZM+InMohAqhQqgQPqoQKoQKoYgcDXil9mzrOdv2v0AO5XJLgyiEshMUQoVQIVQIH1UIFUKFUESOBrxSe5Y8Z3X8O+eZDvZHpuNLfXBwOl479F/7I2WAs8fr56lD/VwZH1/qMB2cmnBEZAMUQoVQIVQIH1UIFUKFUESOBrxSe5YkB0Y0fUb/vlvtOf48HZmO16/9kfp19nP9sO3n2YPT5+lI/SqyIbGRJpObNLb2gxpUzLApFu7UicxNrQYa05nYJyNXxSacqCcxVDcrAMn5WQ1GpoqcyuRGqXffHWnt/9Z07oFpvCtzpgazevbZSHfuXRkoX7DmfhPsBXrqVISPO4PNArF0mAZcmpMkcYOdtn0vc3cmJnnnna2mtd/PBPgzBP7s8id/EuGGlrglGALqeFS9UC8UwRgZQ+FcyAaGgh+iMzTmyScjj6d6QSewsSTMBHNG7rsvMvYliAquO7YLzBmThKhgYf/szyIYCtqG/3BMi7YKbArn4kJPPRXBrw4j437RGUsH48VPBT8G7E+LpcO5uNBXvhL58pcjWEn82nFHX/taDYtTEdkteIf2rLSnMh1Ht/Hx8de1x9FhxdJZS5/7D9seX+ow+1VkQzoJVAgVwj3W3G+iEFYUQoVQITwXhVBE1oF3aM+S5Cy50NLx8de1x9FhxdJZS5/7D9se/07Hua7ZTWQrOglUCBXCPdbcb6IQVhRChVAhPBeFUETWgXdoz5LkLLnQ0vHx16Xj02d0WLH2LHzuP2x7HB3AuFVkiU4CFUKFcI8195sohBWFUCFUCM9FIRSRdeAd2rMkOWvdaelr7bn2c/8VoOf4c/2w7ef+YD2OzyJb0UmgQqgQ7rHmfhOFsKIQKoQK4bkohCKyDrxDe1YKVJmOo9v0YdBtdQR9cLAen1pxZKI2rf2Mg5Xx8aUO08HV8fpVZHPui7ym1dxxR6Tbo/KZmu9+t9WgvMZeoB0wkwy9FEYR+nTLLa2mk6swXtQM3cidIUcCKt9rI52KYFZvy8Tmn5zVVSHAGBlihnMvv7zVtPatTMCVzN9GB8wTNwgRjeAWOj0eedoaw1+56/lAJvEzu+mmVoMLcVbXR/B3h3ZN5vLIm94UYaWO0hwlMlpRi49bISr49aMVNoWRIVdo/eIXI2MTw2aY0JjxuWjFWuGOYCbYkhRzhqjguvVm+0CfoG1oxaywfymeEW4Qt49bwJwRTAO+hM5wLdwRgj9hYJ3xULDOOBcuDQPE/WJxcN3hQ2FxKiK7pby2j5KxTQ1aezE7Ei6RacirFIVQIVQIz0YhjCiECuEUhVBELibltX2UDGxq0CRyPFAIFUKF8GwUwohCqBBOUQhF5GJSXttHyaz1+X92kxOCQqgQKoRnoxBGFEKFcIpCKCIXk/LaFpGjQSFUCBXCs1EIIwqhQjhFIRSRi0l5bYvIUcAyN4vgu+5qNWhtr2s1UBFUuZ16/TqTIzMQ0Ttq7r+/1bSrI50wQIGerul2ksxp/NNWA41p7eGa7n7/uOYHP2g1uNBf/VWr4TOimGGtYK3hlhwqRQX61I0cazX9hFZceWXk6acja0a+rEXSADuL+1HNL3/Zajhy/kRhcXwKnGT8zFp7rGZ8bvf0E9wvimDYBcZCKwp3GAI6o7xG62c+E0HnD30oAm2D1WAo6ARUE51Rx+MG4Q9jJcD2tRgKGoN1hphBRTANSA5GRuexxaEV+6ZiKNzR+AYfeCBy770RCCF+kxgKT/+DH4zgcWPvUzxujDz+MeChfOQjEVwIs8JvI2+fxamI7Ba+JUVkx9AQsp5WCCMKoUKoECqECqFCKCKHCt+SHav/Id/qf8vn56P9LMcTGkLW0wphRCFUCBVChVAhVAhF5FDhW1JEdgwNIetphTCiECqECqFCqBAqhCJyqPAtKSI7hoaQ9bRCGFEIFUKFUCFUCBVCETlU+JYUkV2TW1ayns5WbqXY/qbmxRdbDfywIy+UXHdd5Pd/P9LaoxHU8cM7Yh3fnsuAWzNPZAIsDm6hm9W7M6PVaK/PvDEzPve3I9C2t7wl0v5hJoE+YNmpmlyrb9ScPt1qYK2ozG+8MdLa2zNx+7D0O3Kb3O6vAzfX4LowQD7Qfi/cku4G/00mHxkqdSgBKnVU22hFPQ1RQT2NCyHQNhTuuO70s1gFf6SB1fyX/xJBHY/HgD1IMQ0IEiQWmjpeOlwI5+IGESw7ZgWrwdav43MhZtgqEzKJoTDJ8TS2+qsETAw/FagX1hnXxbLjp4Lr4l8KWhEIIZYuf6IsTkVkt0yVxjz/+B+PskNWpQWPvqo4BrcgFweKSpaq2aoQKoRTFMJBuhtUCBXCBRMbn6sQ1iiEIseUqdKYp5fALYWwFgZsO8+GfXjosMElpq9Lxw/AhZwrxxeKSpaq2aoQKoRTFMJBuhtUCBXCBRMbn6sQ1iiEIseUqdKYp5fA7YUQH0A9vqofSuM+S8cPkaVLLB0/AIc4lBwjKCpZqmarQqgQTlEIB+luUCFUCBdMbHyuQlijEIocU6ZKY55eArcRQvjPJjo022d2nFWxMR2ZqN1mj6NpcGRwfOmsqUN/vLaKFCgqWapmq0KoEE5RCAfpblAhVAgXTGx8rkJYoxCKHFOmSmOeXgIvDSGsR+rXC/y8+oCvg+NrP6++Tp/7ryIEwtDaNzPfjpxqEexvmQr0f/5PBPuXdp424tSpCMprmkmRllfSXeiTNe9+d6t5zWsi3Byyfb+GI78p076a+fPIa7BxaEJPi/uFqKAoonuQMLHOWgM8spdeirT2i8wfRHiDmFU6Xj6y1n6WgcO/NZLL/swzkY7YzpSN7XTkt1rNO98Z4S1wJeNPJ9xiF88MVvOFL0TQGTaFqhfnwh9Qx2NkGNGZMxGU5hjq/e+PYCg4wOdyb8y7745gNbDZKfzwT/80AjPBnCFIUCBc98knI2iFeKMzPA3qBQ/HNHAu7het2AoVTx8XgqfhFtB5vBp4gvgxYEtS/ERh6eNnNP614wcMtUZyzixORWS31FfvDL0EXkwhXOowHmfp66V2fParCFEIFUKF8DynFUKFcF6B0KoQ1iiEIrIl9dU7Qy+BF00IB63jcV7uWOo2fQDogK+HdXz2qwhRCBVChfA8pxVChXBegdCqENYohCKyJfXVO0MvgRdHCAdNrWsdf51Y6naB/Q98fParCFEIFUKF8DynFUKFcF6B0KoQ1iiEIrIl9dU7Qy+B2whhW9CkAzjS+PTZ1np86fPqKz5sfnzp8+pD/xVNIjMohAqhQnie0wqhQjivQGhVCGsUQhHZkvrqnaGXwO2FcKIenO2wYmqq1ON9n9nT68F6HE39wenr+HhtwsHpM76iSWSGH/84ArnC3oE0wPYvM3fVoMyDatZf894v9R2Zt2W24unI9a2m23by55n0FopZyGQXOE+ODJemPzyUeSyTrjW80O23txq4Frb0a7+ZybUiVfBe09773kj3l4V4CpDY1u6s6fanvS1zOpKW3j3Q8UNZeeCU2AqVf1ng00/HywfK33OuFaeBUhVbOKJihk6MLe6JJyIor6EEOBdlPdwDPywU/QjOxS2grIcuYnEwq499LAKNwdJhrRDIBi6EvTExMm4Bc4aHY5JoHUs7rgvlg7bh+WIo/MzQGT8V3CAm+XhKLDqjFUqPznBLPCPcL36xCOQZS6cQilxKnC8sLnXOvdO3Ydv+F5sD3IKcRBRChVAhVAjPBv6gECqEUzBJKB86o1UhFJGO84XFMWSvphV5taEQKoQKoUJ4NvAHhVAhnIJJQvnQGa0KoYh0nC8sjiF7Na3Iqw2FUCFUCBXCs4E/KIQK4RRMEsqHzmhVCEWk43xhISKXBgqhQqgQKoRnA39QCBXCKZgklA+d0aoQikjH+cJCRI6M+2uwVebXvx5hiQx/WANq8ajUOTLreBD+AJtCLQ73QOudd7YaTKOb1c8y36q5+upWgwvRS9uvalD2tPZ/MzdnztRcdVWrwd6ncJ477mg1nZjFMxovXWv/rmY81HPPtZrf/d0I4e8qbh/lJa77hjdEsDMqdlV99tlWg61fsVaAq3F5i7Qf1bDzTS2Cxw/3gD5BJxDsq4mREXga9pn80pciOPe///cIZAMi+tRTkaefjuCJfu1rEQwFJcDtQ1Rwg5gkzkUrRAWChGmgFXcE18J1sWMnZHJ8Lh4KLB23gKcAe/zgByNYOog31grnQvmwGvhdYZIIfpP47zUeN/6l4FxMI1eSxamI7Jb6ehWRI0EhVAjnLW68dAphrIZCWKMQ1oylTiEcRCEUORnU16uIHAkKoUI4b3HjpVMIYzUUwhqFsGYsdQrhIAqhyMmgvl5F5EhQCBXCeYsbL51CGKuhENYohDVjqVMIB1EIRU4G9fUqIkeCQqgQzlvceOkUwlgNhbBGIawZS51COIhCKHIyqK9XETl6vvrVCKv8KyKwx06fYIDgjhpe6Hrsbxl+yM5Z5bf21prvfrfVdLtQPhWhigR/93cRdn5j5PnnI6hkYFPcV/NNEVR9aMXmrlicX/86cu21EdzCqVMR7ueZnVt7V033UIJu2X+RieeLH1K3Yen/l8HPbDQUwmXPvyx0IwfdA43OmPOtt0baNRnsyQlDQOEOYUDVi1r8gQciGAqlOSpmuCWUAFIHI8KsoDEo+vH7xlDYHBKigk0p4dJYK6gmXAvmiTljy0rMeby/JVoxMoZCK1YDI+MWcCFoGx4KOiO4Lh4Z1hlzRjBnDIXniznjCUL5cPv4ieJC2L02t71mcSoiuwVvWPK+942yQ879VfeCWTvIYV1I5IAohOk8gUKYi6MQKoQKoUKoEIrIhYI3LOklcEshnP4/dJYsq3ZY6tM2ELkN2WScTfqIXCwUwnSeQCHMxVEIFUKFUCFUCEXkQsEblvQSuL0Q4gNYOg427LaWTcbZpI/IxUIhTOcJFMJcHIVQIVQIFUKFUEQuFLxhSS+B2wghzGpWtGYPgr7P3v818SyzBwfHa9PswakJR0R2hEKYzhMohLk4CqFCqBAqhAqhiFwoeMOSXgIvghAOxGxFP850pH44lM/TkfpV5GKC2rTdlnmwBm9nbpZ4WSbLaxSQXbWN/LTmpZdaTcddkRtbDfa37C4E4n6xRSf7Zitko6O/x8Ws/qMw0XcY5Xq4NDqEh2Otus6nM2j9YiZMbHXPEzffHIGYrCF/ojDPbi9QTDIeKA1waI8Y6vrrWw06d354cw3mzN8kKnVsjZqVK0vkD3wg8l//awSt0MXH0wAx8kc+EoG3oDM8DRlfCLePon9sJtCJBx+M4EKYxnjksTyjMxQIVtM7Ug2sBt6CW/jwhyOYJKQOSg8xw/PFyHiC+OXgFrA4uBAeKLQNSo+Hghsc/zawklg6bIWafythcSoiuyXf+h29BB62EFbOl15kk3GW+mx7fParyMVEIQwUwprTCuGUSQVXUQgjvQQqhAqhQigim5Fv/Y5eAi+mELaFPpuMs9RncBzMdhO5+CiEgUJYc1ohnDKp4CoKYaSXQIVQIVQIRWQz8q3f0UvgMRLCehyMW0UOFYUwUAhrTiuEUyYVXEUhjPQSqBAqhAqhiGxGvvU7egncRgjbgoANPtevlaVu9cOBP6++zn4WufgohIFCWHNaIZwyqeAqCmGkl0CFUCFUCEVkM/Kt39FL4PZCWGqq/YOly3wfsHTK7MHB8do0e3B1vH4VubigVEXV105lSFTMGKoDlToColJnAX09nOftNT/6UavBrOAP3e6XL0TSadvlmYSbYWJPztdE3vCGCM7FnM+ciXCdr8gk3/52BLvItvbzDB5KGC82le02d41zKVfXZniheIJda+aV0WoSLM4NN0S6bVTjBnEh7E/LZU/e/OYI55w/Bv6BA+U1yvovfCGCInjsAKiJcS4K93ErFAjlNS4EI8riu917b+T9749AYu+/PwIzQSusBrnnnghMGy6N/xRCNVGO4AbHuohWaMzjaa3wJbRi2TFn/HIgzzBPbLKKkbGtKKaBBwptw08FTxCzQsZCiIcyVmskjZfFqYjsFr5TL1V6bbtI7OxCIudAmasQKoQlCqFCqBAqhAqhiFxc+E4VkR2DMlchVAhLFEKFUCFUCBVCEbm48J0qIjsGZa5CqBCWKIQKoUKoECqEInJx4TtVRHYMylyFUCEsUQgVQoVQIVQIReTiwneqiBw1j2W6cjxye81f/3WrmTZNWkFfSuVrr2s11Al6y/OZW2q6c5+KwNPyjuCHUKDOpuJcXBcbWtK023czsRqwVvCOd0S6h/KNTIDCdbyfZTfyo5m3ZX6Z+UXmYzXdj+Gbkesh/ACzeinzs8zfZp6p4R8a2h2Z3L22PZLBNJBvR17favBPg8KAqhe7QUKBUEDjx4GhUF7jXIgKiv6xXeD3ndU29xHF/aKOxy6UOBcCjGlAY3onrIG1Qr2wdAiui0nCPWDpuF+MjNu//fYInBbrjJ/KeGSsFe4Izwj/4cC5mAZ+DPjVYTWwVpgz7gjrjDlDNbHO2Ao1b4HFqYjsFr7nReSoeUwhVAgVQoVQIRwF18UkFUKFUES2ge95ETlqHlMIFUKFUCFUCEfBdTFJhVAhFJFt4HteRI6axxRChVAhVAgVwlFwXUxSIVQIRWQb+J4XkaPmMYVQIVQIFUKFcBRcF5NUCBVCEdkGvudFZOegkE2uGqbdlvmbTEgOL3R9FP0wMaS1+zIo3O/O/H3m3ZnkTRmuxpmaq65qNdh2EjXSjTdGYIDvelerae1bkfSH1m7OxCQ71XyoptPjvEHqcT6ybMWOnbhfwp/KPZkR8HDMGQu75gZJtOLcq6+OoHO3y2i04hf77LOR1h6u4c8blStEBaU5ymtU6iigsXEonAe1OKYBA0Rn2AV2ocRfGtAZQ6Gsh5di90t0hh5jzlg66ATW6mtfi/yn/xTBUJgVjAidsbBwHjwU+BIkFvt54h8/dt0c/zYwMlYSrXAttOKO0Hk8MoI5YzVwgwguhB8hXDrD4lREdgte1eR//a9Rdsi5P+MeHhcy2nTuoc9KTiZR17IRZT2r/NsUQoVQIWwKoUKoECqEInJQ8KomvQRuKYTn/z9yRuK0YR8eujAuZMB67oWMI7Ii6lo2oqxnlX+bQqgQKoRNIVQIFUKFUEQOCl7VpJfA7YUQHwCOb9jtwrmQARVCOVyirmUjynpW+bcphAqhQtgUQoVQIVQIReSg4FVNegncRgg3kb2D9aksNc0er0eWPvedcbxvql9FtiXqWjairGeVf5tCqBAqhE0hVAgVQoVQRA4KXtWkl8BLRghnP+93Kl9n+/QfVp+Xzpr9PB2pX0W245lnIq09WIOi/777Ij//eQRgm803vzmC1q3oqu2Dw2lcGfnhDyPt2gwJQ4A9Ur2ofH+XGepTTgN2QW/5vchTT0VoJv80wsXJ3wa3Bm3viNzUau68MwJe//rIr38dgaZiC1bc7+o/kRO8QQow7ij/soDHfUMm//wBiWvtzhr8w+E0UBPDamCATz4ZQSs05vHcKRSdoV7QNvjDn/1ZBA6A0vxClACBIaB1LDlbnYtJQnG3GvmDH4xAP86ciWBh8U8U/wmG00KPMTJa8WPArpuwVvw28HwxK/yu8APGNPBHivGvHU8B4g0tx5wxSUwjL8TiVER2SxYFHb0EHrYQtvOKtYJte4zHWXvWbIfVwfFQSyOMv4psh0IY01AIFUKFUCFUCBVCEdkhWRR09BJ42EJ44X3q11KGnKXvMFE74GBlOo5ug68i26EQxjQUQoVQIVQIFUKFUER2SBYFHb0EXsJCuOHxenDpFDDutnSWyEYohDENhVAhVAgVQoVQIRSRHZJFQUcvgdsIYVuwsqXP/dcJnFKHXbrEuE//YfUZX/vjS31EDohCGNNQCBVChVAhVAgVQhHZIVkUdPQSuL0QTtSDpct8H4DTl06pB2tT33nwue+M47UJ3US25nd+J9J+I0Ijek2m3ZoJI+KVwE0RuAeKfmw7ic0hsdMeNebyyFabUlInElx36V/ped6ewXW/X9MNdSYz0pju3LzQKwtSc1MEtShukEO1t9R0C3tXBucGlNi8wbe8pdXgt3HllRFMAz8GFJCtvS2Tk3xl8WoSXLe1d9Vwo1SK6O0R1MRQPuzJiR0sv/jFyNNPRz796QiUAKU5hsJ18WtA8Y1WyAZuEFaDaWDXTYgKgqIf04CnwS4QTAPKB1FBsFY4Fxcaa9ujj0Zwg//hP0SgmvizBIb60z+NYM7YzxO2jF8O/kvx1a9GcEfojN8GOuPHj+viJ4rOWCvMCr+rbGVxKiK7ha/YS5XzldW5z9l4ZNRZiRwQhXAwZ4WwhkMphAqhQqgQKoQicsHwFftqYK/EEjkuKISDOSuENRxKIVQIFUKFUCEUkQuGr9hXA3sllshxQSEczFkhrOFQCqFCqBAqhAqhiFwwfMWKyI5RCAdzVghrOJRCqBAqhAqhQigiFwxfsSKya67KXJ1pP88Ef/u3EYBN++6+OwLJgXpxn0nM6rJIpyJR1qNEZNH/2lZDA7wx0l3osUxI3WWXtRqOjGnkppRd69/XdEOFEKIIRGtrL2W+XYMKqrVHIvnnAIo35/xszVhTYTHr5BncHMnfc6eauTNq/pBwIdxg90P6mxrUonhGl18e4b8FSA4qZgQP+CtfiWAoVMyop1Eij6t8dMZQCKp8GBFGxiShizBPGALEDLePtcLIsGU8QswKgoQL/eVfRrBW484wsf/xPyK4XwyFlcRvFLfw9a9HMBT+EWLZv/a1yLgVO9Did4VH9uUvR/BQcIPYZRRzHt8CFjZvn8WpiOwWvNdFZOcohAqhQqgQfk4hVAiXbUohFJGLCd7rIrJzFEKFUCFUCD+nECqEyzalEIrIxQTvdRHZOQqhQqgQKoSfUwgVwmWbUghF5GKC97qI7ByFUCFUCBXCzymECuGyTSmEInIxwXtdRHbPw5kf1Xz/+60GRtQJ0sgeuwuhyo/yumuNWbX2schQ27o6HhtLhtR1rhWzguPxjk61GizdWDbuuiuCOXezCv74jyOt/d8MHsonMzEraBvoHveDNbgF7KuJO+oeym2RlLrOPEHcwje+0WpwC+2mFsETvL5FcuTVxZb4/d+PUFNvwnVzZNTTMBPUxNhJEltHosqHTkBU4Eu40Gc/G8FOoWPnQWdU+SjcUeVjK1hYHIKh4KVQEdwRXBr+8LGPRfCTxTPCasDxoMcYCrePzpgVzsW/OpyLPUjxuLEa9XfyeLefJzrj9jErDIXOmAZuH/cLXcQ0sM745WAoJIdicSoiu6W8ToV8Zw8e3YwNT7yQS8ixAZ6mECqE83SPWyHcRyFUCBXCc8FQ6KwQikhHeZ3OszKWiaXj31mwmtkOS50PwCEO1TMYfNC0YqlDf7w/IicNeJpCqBDO0z1uhXAfhVAhVAjPBUOhs0IoIh3ldToPdGX6uonGXMi5G3KIQ/VcyOBL5/bH+yNy0oCnKYQK4Tzd41YI91EIFUKF8FwwFDorhCLSUV6n81yI1M32+U5hOjIdn75O1K+rPtOR6Ws9cq5rfl19QM+J1RGA46uvU//aujo4MR2sTX3P1ZHpeP0qJw14mkKoEM7TPW6FcB+FUCFUCM8FQ6GzQigiHeV1Os+SumziMEt9+jHrkb51+lA/48P4az0XX9E0gYPoNnv60ufVV3yozB6UE8Nl2GgRoCZ+IhOtb3lLqxkb0YsvthpuK5qde/lMMwmwiV3HLzL3RFLqYDWYFbbofPbZVgOLG/tSN/ItmWwduhZUBOvcdc6Rr22RHOqNb2w1rT2VeS6TRsQb/GYmO/M3iXMRTCPAU8Avh7qYLg0RfeCBSGuP13S/yaczMWd2xq6MkCsE5TWKb/gSWhHsXwptQ2foE1pRbY+36IQ+Yc4wMSwO/AHnYq1wg3Bp7H16332RBx+MfPzjEcwKS4dWDIVpoPVDH4rgP2fj68K1cPsPPxzBSmJW+JmhFRfCJDErPKOx8eK3gVY8X1wXc8ZQuP2USRanIrJb8O7uWYnNxNLx7ywozWwHdN7wK46vWOqMr0vHZ7+uGPdZO/KGx1fMHpQTA4tvgOJbIaxRCBVChXAvCmENWhXCGoVQRDrw7u5ZcpWl4wOWpGjDr7NXXOqMr/1xUFtX4ODS1ws8vmL2oJwYWHwDFN8KYY1CqBAqhHtRCGvQqhDWKIQi0oF3d8+SqywdH7AkRRt+nb3iUmd8XTo+YHzK2pE3PL5i9qCcGFh8AxTfCmGNQqgQKoR7UQhr0KoQ1iiEItKBd3fPkqssHa9sKEWDr9/ZY/YzPvRfZ/v3Tauv0+fKoE8deenz6gO+4vjsETlhsPgGKL4VwhqFUCFUCPeiENagVSGsUQhFpAPv7p4lXVnJT4U99pjtgCO1aToydait9fgmR6bjtcN0pPacpTahG5oqfYf6Fd1qk5xYUF4/lkFZD2KfSRTQHCo1BjXxD34QYcXcHslgVuP0CjFInpt+ePfdkda+H7muRThy7PaJDR1x+1jYdfb4Yg0UqNtldHi/7e6a665rNR13Zj452L+Up4I0wO7p3xrJzt0k87pXtMjrI92FHqqhAea5+HnjCUK8kR/+MEK5whadcACMhbIeNTFqcVTq6IzWrJhZXkOfIFe4BRTuH/5wBOfiunAAGAJGxj6TcC2ci+vi9uGluBDOxVPAUNAndMb94qHgVzjevhXnjpcOYgaH/8AHIhgKF8JQuEEEnbGw0Da0YijMCiNDYqH0uT8ti1MR2S1ZE0gAc9uEA/Tf9hQ5fqBwVwhLFEKFUCFUCBVCDIULYSjcIILOWFiFUOREkjWBHITJ6LQ7ORgo3BXCEoVQIVQIFUKFEEPhQhgKN4igMxZWIRQ5kWRNIAdkpYLaoBwMFO4KYYlCqBAqhAqhQoihcCEMhRtE0BkLqxCKnEiyJhCRIwCFu0JYohAqhAqhQqgQYihcCEPhBhF0xsIqhCInkqwJRGTnXHZZBGU9t2G8vkXA5RkYAqwmK3VUuX/7t5H22kjnPACiciZzf82VV7aav//7CO2C+gTek3kqkrfQbXZ6R+Zdmdsy0dpt0BqcOhVpV2XaO2ve+c5WA9eCAnR3FNB5ciVhYu95T6S9JpM/pD/6o1bT3VF4WufDAM/3bTU/+1mrgYi29m8y4fBcKxLi3b72tQjKXFTqsEfsJAn3wB8e4Eu4EP4RouiHEI51EXf01FMR3AKsFdeF83z2sxFcF8ENIpANzGp8XVg6rounAIvDI0MrVgP54hcjOHfsS3j6uEEMBbnC7WNkLB1WAw8Uv+exLWMaWA1MY7xWmGSuBotTEdktfEmKyI5RCBVChVAhPBuFsGZ8XYWwBkuH1cADVQhFpIMvyY76v47z89F+luOJQqgQKoQK4dkohDXj6yqENVg6rAYeqEIoIh18SYrIjlEIFUKFUCE8G4WwZnxdhbAGS4fVwANVCEWkgy9JEdkxCqFCqBAqhGejENaMr6sQ1mDpsBp4oAqhiHTwJSkiOwc1cQYWlypy222tBq3dpqPph0hW2zi3G+otmZgzOsNMMGcIIQUYipv55jcj7bcyVBEoH5Y6NQbXSonlJKmpWFvoMcA0oKnRCl+g81w/DEa+qUXatzOnMyC0rf3DVgMBxo+h+1PCmczba2CtaMXi/MEftJqOb9XgV8dKHfqE8hp1Lep4BCOjFVU+Rka1jbJ+bFOo43EuCnfcIK6LOaMVF8LWoDgX00AgKtiTE5NEK9wDI2Od4TxQa8wZW2XiXPwjPHMmcu+9ESwOlg4PFDeI/VphcVgc/IC//vUILoT/jOK6WA3MeWyP/SOucZdRkUsJvjOT6X/ANgt7n2D2akKRAwIlyCiEy1EIFcIpCqFCqBCei0IoIlvCd2ZCBUzYu2OvUiL1YNZUMwfr8b7D0vG+aUV/vD9yMA5rHDmZQAkyCuFyFEKFcIpCqBAqhOeiEIrIlvCdmVABE/buOF8szR/pm8bH+69Ln/uvSwf7IwfjsMaRkwmUIKMQLkchVAinKIQKoUJ4LgqhiGwJ35kJFTBh747zxdL8ETRN9McHpwyaevo+9chqbitKl42O16alg1PTdFBkBZQgoxAuRyFUCKcohAqhQnguCqGIbAnfmQkVMGHvjr1Kic6Grz398cEpg6aevk89fenz6gO+Dvqv/SwSvOMdkXZlJovvH/yg1YxL5NZeiKTyYefMW29tNdhJEq2o8lm4/9NMcu21EdgUdAL1VWsPR65rkdxnslsNaFtk9U90AnNmayoQ9yC9IndwvTECqUMgzy+8EHnmmUh7Y6Y9XfOrX7WazofTD195ajVculRr/pC+V3P55a0GPoxfzlVXRbo/f8Q0sAUr/i1AiLC7J5T+pZdaDXUCRfDYD8dlPSpmDDW+LtQLDjDehBPLgTlDCDENtGJkzArn4rpwAMwZi4OlG68k5AqLg0l+5CMR7FCKG0QrHgr8EK0PPxzBsiNYOvztAJoKIfxn/ywCl8aFvvzlCK6LtcK58ENs0ArV/MpXIvgx4AlmK4tTEdkt+xXPHFTAhL07VmXVVFzh6+rzfolVDk6fcWTQtPrcj1apHSamJvSsXyfW9t/wuMg+CqFCqBAqhDPXRaWuENYohAqhiBwe+xXPHFTAhL07prLqXBGVB8GgwyZNYPZ4fxAzrNQ+/fHaoX5F53p8v7dIRSFUCBVChXDmuqjUFcIahVAhFJHDY7/imYMKmLB3x1RWnSui8iAYdNikCcwe7w8ORl6B40v9l45PLB0XUQhDzBRChVAhPBdU6gphjUKoEIrI4bFf8cxBBUzYu6Mvq+pBtK493n9d+tx/XTpYLzo7Gg7O9l/6vPqKDyJEIVQIFUKFcOa6qNQVwhqFUCEUkcNjv+KZgwqYsHdHX1bhYJRYcwfr8b7D0vG+aUV/vB5ZOr0erE37vc+39sfrwemzCDhdQ7kCqUD33x9BlX/zza2GFvTaVnPZZZFXauRMnNvtFfn7mdSJV6yvpLvBnBV9OHSCI+deoD/6UQSmjetis9Prrot0C/tIJqfB5B2toT+9JnlTpFvJv6rJPfx4IT5Bmthoo1QU6q39OAPyjl7TIiSs9Xd/t9Xg3Le+NdKtxj0ZLOxdERTf8BZYHIrg9743gnVHTYw/AKDaHpsnanFcCOqF4nvsLdCJe+6J4ELjOUMJcCGsBhQIooI5Q9uwGhBCnAtpRytcCxfCudAnrAaeLyaJ20ewdJjkWPk+8IEIVhKdcSH4P+aM68ItIc/4TwOu+6EPRfInyuJURHYL38YisnNOK4T7UQgjiUKoEE7BhRRChVAhFJGDwrexiOyc0wrhfhTCSKIQKoRTcCGFUCFUCEXkoPBtLCI757RCuB+FMJIohArhFFxIIVQIFUIROSh8G4vIzjmtEO5HIYwkCqFCOAUXUggVQoVQRA4K38YisnOiVIWZ3HdfBKBzVxNHed3VxOlaN7UIOnNjyZEfYv8/jIyNNHELFJX2BzXcHLLdnRlC58mtQbFDaarXDTdEsDh1I6lX6J7CczVda3J9Bk8hNyzthoI8vzcTjofdXLFdLSrVdlUmL3THHa2mtf+diR/hnXe2mta+HUnDx3XxU+meICQ2lo7bmeLvHajyUeZCCaAxKKCxoSXsAoFOwGo+/vEIzp0ezyqwGvgh6ngoAYLbh+SgyofyYSWhExAV+AMUaHyDeChYHMwKW4OOlx1PEK24QdwRpoGfCpYOwVBf+1oEqwFLx2rAD8frjL8djH/tsEf8JQWdP/rRCM7Nh8LiVER2y14JIiJHSVSuqHoVQoVwPzcqhPvpnqBCqBCej0KoEIrINuyVICJylETliqpXIVQI93OjQrif7gkqhArh+SiECqGIbMNeCSIiR0lUrqh6FUKFcD83KoT76Z6gQqgQno9CqBCKyDbslSAicpRE5YqqVyFUCPdzo0K4n+4JKoQK4fkohAqhiGzDXgkiIkcIRWXUSgfYE4P9pLat6Xz90D2Q326RbIUv/eVfRlr7VibOxSQhV629q6ZrTZ1oj2Viz1Wciz0qeb8kW69okZsiuNCtt7aaK6+M3HVXhLeQj6xbWPjw9zIxZ5jYFVdEfvrTCNXr2vE+seAbNVgNLF0nk3gKsXst9rPkJHnu7TVr5owiGBqDC6OAhgOgFWby4Q9H4FpwD4wMf8DaYQtHKBDcEpPEdccWh1lBNvDXINgyOkNTcSF0rjr0SrCwOBedEewii6cPX8IzgkzCiLDseGSwuPGc8cjGcoWR8UBxC/ipYJL4tWOtMCv83QG2jNXAI8sfIYtTEdktfC0mt9/yzwdh70PibM1wdBzt1eVEohCW0B8UQoVQIVQIFUKFUEQuJnwtJr0EbiWErATK8dKLjFtX9H36IwfjsMYR2RiFsCT+m6EQKoQKoUKoECqEInKR4Wsx6SVwWyEcfF1ik259n/7IwTiscUQ2RiEsqfKw969RIVQIFcK9KIQ1CqFCKCKHB1+LSS+BhyKE9fh+nVCOzB6v9McxwuzpmxyvTUsHp6bpoMgFoBCW1H91e//GFEKFUCHci0JYoxAqhCJyePC1mPQSeLhCeK5CWD5Yj1f6g7Onz46Pr4P+az+LHAIoVfHu7srcECS0rn6dE7/1W62mGwo8kfl+zZkzrabj5shYYq/ClpWxOST0Cc6DG+R1eYORr3611aCgwrJzzu3xTG5o+doWadjtEzxUwzt6U+xuCmln5/bXmbhf3AJEFKVae0OGO3aCb9aMl65byZgkzn3veyPY+xSG/8ADrebv/i4CXex2r81fzgc/GIEhwFvg5VAglNfYKxLVNuwCT2WsbdgLFEOhNMcd3XtvBJ1R5cN5MI1et2owSbgWdBHTwB0hmAa8BcEdYcNSrDPOxfNFZ4wMX4LTwqUxMnwJ9zu+7liP8R87/J6xkngoaMV18bsazwr/2nNxWJyKyG7Bax70EritEGb1sn8cHyo4uNSnZ2pCz/p1Ym3/DY+LXCiomPHS7MRGIdyH1+UNRhRChVAhVAjPRiFUCEUkwWse9BK4rRCOP9eDEzi4SZ96ZL9aOk/t0x+vHepXdK7H93uLXDiomPHS7MRGIdyH1+UNRhRChVAhVAjPRiFUCEUkwWse9BJ4YCGsX/sPlaWzxgfHY7bu+FL/peMTS8dFDggqZrw0O7FRCPfhdXmDEYVQIVQIFcKzUQgVQhFJ8JoHvQQeuhDOHlx9mP26dHB2TByvB2f7L31efcUHkcMBFTNemp3YKIT78Lq8wYhCqBAqhArh2SiECqGIJHjNg14CL0QIpyP1eKltos/S16WDs2P2Q00Ha9N+7/Ot/fF6cPosciikulzear7+9QjK3Pvui7T2thq8f194IXL//RHOKavtH/wgwu09b8qdNq+P3HJLpNtXM2+/nanB3pit/WEN9lnE/bZ2Sw2ui5Wk8V6Twf3mDbbXZ1I2MMnnn49g6bBZYLsyk6b9N38TgTy39nwm1vmnua1ot87YGPZ0JoQQs+qI6/KHdCoDMHL+03jDGyKQKZTid98d4a8OlToKWUgOSnP4EuaBEnmsfBgKgoRbgrfg148LQQlwg9AYOC0mCakbewuuizzxRATr3PevGa8GOmPO4+tCF8f6hGngKcCXMA3YMjpjYXEulG88K/wIsTj4meHHgM4YCj8VtOLHgOS5LE5FZLfw/SsiOydrU4VQIVQIV2BkhbBGIRysBjpjzuPrKoQKocjJg+9fEdk5WZsqhAqhQrgCIyuENQrhYDXQGXMeX1chVAhFTh58/4rIzsnaVCFUCBXCFRhZIaxRCAergc6Y8/i6CqFCKHLy4PtXRHZO1qYKoUKoEK7AyAphjUI4WA10xpzH11UIFUKRkwffvyKyY+rmRXN7Fp2uwWaJ/S6ONRSkrKc7Ibyj5uqrW01r763pto78Rg3ME+rV2s9rumlEpc4L3ZRBWZ8WBxO74opI+50IL5R39OyzrabbRzSmgb0Dub/lyxEUn900wi3bZS3SHswkV0W+9a0IZ4WVzF1Gf/WrVgPXaO0PIte2Guxu2trTmSTnvI6YM5YOC0vzvC6D4htBtY2gMwpoFMHY6xat2OAR3oILoRaHMIztAo/wyScjUAKcOzYxtGLkseKO54w/luB+sRq4EIaCt8DDMRT+NgaLwy3gLwv4MeCXgwthkrgFDIX/uOOOMEn4P5YOs8JQyEc/GsGcEVzoz/4sksvO4lREdgtfsCKyYxRChVAhPIdCqBAuzVkhVAhF5KLBF6yI7BiFUCFUCM+hECqES3NWCBVCEblo8AUrIjtGIVQIFcJzKIQK4dKcFUKFUEQuGnzBisiOUQgVQoXwHAqhQrg0Z4VQIRSRiwZfsCKyc+6pwcahnYr87xrsnMktHHPbyT/+41YDu0Dh3mlqmMnf/32rIVnW08Tyum99a6TjoZpOU9OXciVhNa3dFkl75IaWKRtYHNhUt1aQq2/WUPnyupddFlnDDRk4D2//PTXvfGer4S8nnyCV/rcy7Sc1+HNAtzgJl/2LmVjJN7+51XTA0p+IpAHyfrHLKv5dwdNQ9GODWrSiNIcBfuhDEZgYanH87QT7TKL4xrnwB/zRAq1wPPgSZBKdEdw+hhpf6N57I9Bj3CBUBBYHL33f+yJ4KGOJRWc8FKwkzn08tzOFAH/kIxFYHFqxdLhfLA7uCCNjKNwChoIA9xJYg6HwR5qcM4tTEdktfKMm7xvC3pcqM0XIUXCJTEMuQRRChVAhVAgVQoVQIRSRo4Fv1KTqXw97L7BUCcwenw7WptmDldkO/YdN6Dv3Rw7GYY0jxw+FUCFUCBVChVAhVAhF5GjgGzWp+tfD3nPUAmDbz+ODlXGHcSvoO/dHDsZhjSPHD4VQIVQIFUKFUCFUCEXkaOAbNan618PeHTNv/z3649ORvmnpYGW2w+yY+3XJ3CltbqhNTt/keG1aOjg1TQflJKAQKoQKoUKoECqECqGIHA18oyZV/3rYu2Pm7b9Hf3w60jctHazMdujHrAXJfHEyN9TsKfi8+oCvg/5rP8uJAntF/iKD1nAeClLW8fAWnEszyXp69XOcQOH+7W9HAEoICmGCmgE60X4jgo1DO/X6fISykZ3ZGtqGMg+sm8Yva3CDSLfrZihut3TFcM7m4UzsE4s5Y2Q8fWSd8f4gkiLKG7w+k+sM82rtlgx+/LHOuFD3e34xEz9vKi4ECVIHFUEdjxIZDoAtHOE8qPIhG/iHhGCSKOuhmjh3XLgj2FgSF/qP/zGClRxLDv6ZYSVx7nidMUlcCKuBnx3uCAvbL0gNHB6PG+aJVvx3BAKM2x87PKZxzz0RLB2UHq34qWDO6PzBD0bg/3goSN4gi1MR2S37xcIcVf962Ltjr3KYoT8+HekKj8WDldkOgw+zX6eDPVMTetavE2v7b3hcTg6oeicVXAWtIXUKYUYhVAin3/OLCqFCqBAqhCKyCfvFwhxV/3rYu2OvcpihPz4d6ZuWDlZmO/Rj7hc059nvfZ7+4HSEJ5ees8drh/oVnevx/d5ykkDVO6ngKmgNqVMIMwqhQjj9nl9UCBVChVAhFJFN2C8W5qj618PeHXuVwwz98elI37R0sDLboR9zthvo+6w9HceX+i8dn1g6LsceVL2TCq6C1pA6hTCjECqE0+/5RYVQIVQIFUIR2YT9YmGOqn897D3HXvFwwM/jg5XZDtPB+uEA11p7Og7O9l/6vPqKD3LSQNU7qeAqaA2pUwgzCqFCOP2eX1QIFUKFUCEUkU3YLxbmqPrXw94LlCpi/fG+29LBymyH6WBtnS46e0qbG2qT0+vB2rTf+3xrf7wenD7LiSJ1IqXuhhsird1fg4oCeyei7OmKb/Dzmk4mc5LtpxHKFcC5n6z5+tdbTbsigml0Rf+ZGtRIVGtMMjc75baT7Yc1zz/falp7W82/+let5tZbI9zONMH2lnANrEY3yYRPIda5k6u4BQ6FR5Yj06byQj/6Uavp5oxZ3RX57RbhLyeCYrtjtGEp9lylP3zucxFs4YjOeGYo3OEt6IxARVC4Y1b4uWMrVOxW/Hjub4myHq1wALSOA9XEHeF+0RkqMu6MhUWwVuNJ4roIbgGeNr4QzsVOsJgG/u6AXWTxY8BfFiCTEDO0YlZ43Ph540KQZ6wVfle4QVwob5DFqYjsFr5CRWTnZKmqECqE56MQDqIQKoSLGXva+LoIbkEhVAhFjiN8hYrIzslSVSFUCM9HIRxEIVQIFzP2tPF1EdyCQqgQihxH+AoVkZ2TpapCqBCej0I4iEKoEC5m7Gnj6yK4BYVQIRQ5jvAVKiI7J0tVhVAhPB+FcBCFUCFczNjTxtdFcAsKoUIochzhK1REds2Vkc5qwtPqfkR72xCF83S+lFyP/R7BLTWogfEqf8c7IvBS7CTZXffumiuvbDWt/XkmOsMesQlnN41HajoffnuGvpFJUpDgPN0dxVDdM4rWblvROzPfqEHNjz8ldBcK2Jrn/ot/EUHru94Vae1dNRgZiwPD5yNLAcbidD/+0R3hcWM/S97+uI6HayGoiVH0o0RGpQ6dgAOgM8prTBIXwjRwIXSGTeEGcaHPfz7yla9E6jL2gfNgklARTAMqMtYYBCuJWeEGsdcrJonrIhj5qaciY5vC833yycj4l4OhsHRQa9wRgjcQLoT7xQ3iQpBY/FQUQpFLCbxSRWTnKIQK4fkohAqhQqgQKoQismPwShWRnaMQKoTnoxAqhAqhQqgQisiOwStVRHaOQqgQno9CqBAqhAqhQigiOwavVBHZOQqhQng+CqFCqBAqhAqhiOwYvFJF5IhBxQz3aO3zNT/8YatB8Y23c8fNGfCtyE2tpvOWKNxfqa8zaMV1Q/lauycTcHESVPndJB+roYrktpNsrZZydqiv1uC6/8//E8Htd7O6L/OzmssuazVj1XzxxVbzO78Tae2ZGhoRH0oEnfGrC9u/fu9JBDEUnuCPfxzBnqvt9ZnXRrpbyD9D5Ham418Oa2J4CzwN/gAHgFzh3KefjkCuoCIYatwZu1/CLiAM8KWxqEAJcC7cEg6AWY2lDiuJdcbtY+dMaMyDD0b+9E8jvcjVYJJYZ4gZ/nKGR/b+90fG2oaVhGthNfBQPvShCCaJtcJDwXXRimATXdw+/kaFp4DOOWcWpyKyW/haTF7+n6O8Gun/rHxR2fHl5DjAylUhLHBxEhhCN0mFUCGc/+UohAqhQqgQipxk+FpMegk8gBAu/T/4zIJuG561ObMD9gf7IwfjsMaREwQrV4WwwMVJYAjdJBVChXD+l6MQKoQKoUIocpLhazHpJXBbIaxGtIkdbdLnQpgdvz/YHzkYhzWOnCBYuSqEBS5OAkPoJqkQKoTzvxyFUCFUCBVCkZMMX4tJL4FbCWGvQ9ORl5P+IPrPtk4d+uP1YD2OPksHcUo/zobHa9PSwalpOignGlauCmGBi5PAELpJKoQK4fwvRyFUCBVChVDkJMPXYtJL4OEK4ezn1Qd8HfSvp2wyTj2+dHB2fHxefcDXQf+1n+WEgkoGBsjWLHOx/WNrf1fT+UPuq3lZi1wf6Qro2O7yuutaTWetyeWZVL7uQn8T4cgxjdZ+VIN6g+fiflNET59uNTi3m2SYGMyEVsNbeFsNSsR3vjPSAXmO1ehUM0zs/2fvbGAvreo7fzJrCEuodYmhhiUsS7su69KWUpf6tnakVF3tWmot62qts9QiRUoRERF5G16EYeRNEXVZX9CiUlReXJew6rKz6iK6xBBqCNHGEEMMIYQQYgwhZnZm7swz5/s5957/vfP/z/2/zOeTb5p7n3Oel3Oe5z/P73PZPeLHglKeysRKoThR8xDGkTF8jAgFZCP8v6xDx3txJhdZRWfcI8wG/hZ4oiuuiGzaFEHFjNIcDvDxj0cgSFjtFHL1la9EUNbDWvG4X3tt5OKLI7AaXCSGAEHCeTF8GC9uP86LVvxkhSP394VN3Zwy2Xee/g3tXyRMG/cXMok7iENhnjGTaMUfIa4ZfohWLFiKdBf/jGWdtwUnwkViYjEbd94ZyZ9dWJyKyHyJWqOhlcAlFMK9uh1M6j9sbBma0LP+OrBg/ym3y74Iq+30B7YqhAqhQqgQKoQKYR2FUEQWR9QaDa0EriIh3Jq0HQbajXV/UPdpt9cd6q/oXG/f3Vv2TVhtpz+wVSFUCBVChVAhVAjrKIQisjii1mhoJXC1COGU2ydt7PcvzfZJ/SdtH5i0XfYhWG2nP7BVIVQIFUKFUCFUCOsohCKyOKLWaGglcCYhLCk8+FzL0iRxmtRnmv71xrHbB9qNY8+F7fXGsf0nfR59xQfZd2G1nf7AVoVQIVQIFUKFUCGsoxCKyOKIWqOhlcBZhbDsciGYz7ARTdgytgkbh8/4WncetqP/pI1jj4Nu9ca6aXfvXa3t9nrj8Fn2Wa6pc9JJpU793Ox4XFBPP5kJUSnl65lobSr1W+ugUv3OdyK4DCwmR2stH6mzfn2pw9KcAwwzOfPMUufooyPllZnydAZHDjG7665SBzXhC18YoXq9KMJFOCGEmSeeiNx9d6S5oTEbUKATTojwLuyPhVKz9eBS58gjI30DLOWjmTwyhoxWGv6NdR55pNQp5YHIfiWST3vj8HH377ij1GFdi8IddS1WCkWljnq6tpRtgVyhc5bIDGpxtGIIuGZcxubNEfwBQxfRChPDVKIVS4PiMiDA6IzxQmPQipns3zIoENbzxD3CeWGAcGlcFWYDt6x1szqQOowIXooBYgi4SAQXiQHC8TBATF3/ycFV5XlZnIrIfNlejS4HipDIgEKoECqECqFCqBBWUQhFZI5sr0aXA4VQZEAhVAgVQoVQIVQIqyiEIjJHtlejy4FCKDKgECqECqFCqBAqhFUUQhGZI9urURFZVhRChVAhVAgVQoWwikIoInNkezUqIsvIww9HSrktc3bmm5koc1GaonBv6vhY4LGp1ENFvva1UqcRlcfroKL40Y8ipXyuTntheZGP1WHrusgzz0RQ1aNwxVxhRPBwrLTHy+BimHGo/okWcq0e9NJyRyZPRCGM8zbaBuJQqL1LuSeT5y0nZLZk3hDZZvV1kiefjDQyGbaMmeS6uNgX1TaKYFTMqInxcMBqbrihFxwZFTN+lsCRUYvjcYcfwi4QrOeJVrgHqnz8dHRzKt/110cwsZgN/EaFYNoxXlwzzosVWXG7MQQcGf+c4VBYNhbTjqVfL7wwctllkauuiuCqcM1YRhX/ymCusC/WPsWhcFNwQ7EvJgdTh0PhHuU1szgVkfnCN66IzBmFsBOFsINCqBAqhDuDa1YIFUIRmQW+cUVkziiEnSiEHRRChVAh3Blcs0KoEIrILPCNKyJzRiHsRCHsoBAqhArhzuCaFUKFUERmgW9cEZkzCmEnCmEHhVAhVAh3BtesECqEIjILfOOKyJxBfYVS9ZJLSh0WssxXM6GLTefgvPMiKOtRq6CVGkP3yPPCPZ6XWYA470EHlTpoPf30UqeUJyLrS+TgTB4KC6WWckqd5kQn12mWu+wTVsOpy7lqzov7++o6vEcJqr6mc4wIJ0JZW56fyX1RTiPQVAhReWEm7wLGi/M2f0fRylIVVS98CWUu/oBRmmOEOBQcD6oNfcJFXn55BDKJZSchdVju8uqrIxgRdAInuvTSyJVXRnALMXXQJ6x9CtnoqxesBlOH4eP+QttwIvzbt2lTBOPtyxWeDazJ2X+u8Khgrj70oQiuuT8itOK8/VY83hg+ghuah2JxKiLzJWqChq233dYJe69Rtk74n0yctF1kNvCGRbXdFLIo+hGFcHcaX1IIFUKFUCFUCLutOG+/FY93K4F1FEKRFUzUBA2tBM4qhPX/qyu2TQd23OPjDNSXNMBOFZNaJ20XmQ28YVFtN4Usin5EIdydxpcUQoVQIVQIFcJuK87bb8Xj3UpgHYVQZAUTNUFDK4EzCSGUac8Mas/2moYpjzyp26TtIrOBNyyq7aaQRdGPKIS70/iSQqgQKoQKoULYbcV5+614vFsJrKMQiqxgoiZoaCVwMUJYM/ynuVYa641Vr91b2s7YWDcN21va1mGvuqneiO1j+wwbRaYCb1hU200hi6IfUQh3p/ElhVAhVAgVQoWw24rz9lvxeLcSWEchFFnBRE3Q0ErgkghhLU6dz/jQbl/w8+jr8BlMOjK+Tjr4pI3DZ5GpQKnKWny/TK66iQKjlBMzYTVPPVXqNM7zxsxdmajUMYTmULHvAw+UOqM/koHynBLJQ6HobewxZqOsy3VHy8/qYDHIAw+MAFR9Gzf20qxgGXDaD4igYG4WDo3ZwNT1KS8qkTxUs7bthsxlmTBA3FCED/DhGVrrTZnHuwG3ZmKA+NPgVeG8/TIX1TaWf8SZZlpoEa71+e5CmnfeGcGjg32/9KUIBAlSh0PhqqAiCM4LT4MA1786bAv+zHBe7IvgmnEoTB0CP8R5+z8H/N3fRdAZzgPVxHnxbGDZ2K98JXL77RE8dfB/jAj3CJeBnyFwZOwLEe2PCE8sjpwTy+JUROYLX7BJK4EzCWHZJUg765NqY9UlzKrePnbjpM4Lbm/pNJUpDth+GPtVZAEUQoVwiELYDVAIFUKFcEcUwjXHtkJyCNtE9gJ8wSatBM4qhDXbS5RdHwA61GDjpM4Lbm9pm3Zf0A6GjejTfgC7e4ssiEKoEA5RCLsBCqFCqBDuiEK45thWSA5hm8hegC/YpJXApRLCbNnJ2O3YOOkgC25v6fdc8IDtB5E9QSFUCIcohN0AhVAhVAh3RCFcc2yrK4ewTWQvwBds0krgTEK4vSYZ93VnudLd3n5ot0/6PPow9mtNp2fn4O2J6o31dpGpUAgVwiEKYTdAIVQIFcIdUQjXHNsKySFsE9kL8AWbtBI4kxCWXbK0sz6ZZfukLWObsHH43H6taZvqow2tw8ahadhef247iEzH+syRmSxz6/128FDmmcghpc6WLZHmyM9m0Bp1POq6Uu6PUGI3ZD6RyRPtjxVKN9bBEOhaeajjjy91uLopkuuIPvhgqfPTn0aaIQTPPhvhZYze8EPymvHrQCPAOVeZZjnTd2Sg9OHSjS/lg4RzbfPnKk8/HYGWP/FEpJR76yzwY0G5J4Np31CnGQKIIRxwQKnDehqV6/XXR1D1QhhgRPCWv//7CKpteBrUCxeJQ0H50BmFOzrjFw4cGb/KfPSjvWBysJAmxPuKKyIwbRwKdwEDhLTjyBAzLLOJI8PxMHVwLfxTCPPE3ceR+zcUdx9HhpfCHvFzQN/x8DAg/d8O8AMHbhmmDvvmkVmcish84TtTRObNeoWwikKoECqECqFCqBCKyBzhO1NE5s16hbCKQqgQKoQKoUKoEIrIHOE7U0TmzXqFsIpCqBAqhAqhQqgQisgc4TtTRObNeoWwikKoECqECqFCqBCKyBzhO1NE5swdd0RQ5h50UKlDYcgS+cUvLnWaEvnsTJ+HI+vTWo+INCeK4rup8sNMmiU6w0shDDRPiAqdZ0skl/eEER17bKkDP2xcKzjyyEjDJXWadURn4Je/jKDMKy/IlBPqNHcBU3d3JmayeUS/nIlD4RH91rcipZyRuS0CS0+3BFgcsU+zqOxPIqhcUYtj6Ug4AKp8VL0o3OEAWFjy1lsjuCqcFxeJE2FfyEbfH3AiqAjOC3/AifDowJZxCyEqaIWJ9a8KmorzQnIQ3CPoIqwVF4m/SfgwDoVbhuHDWnEo7Asxw2zg/mLxT9xuPDl4nnGRuCosz4tgnvPPisWpiMwXvjVFZM401fYGhVAhHItCWINSvI9CqBAqhAqhiEyCb00RmTNNtb1BIVQIx6IQ1qAU76MQKoQKoUIoIpPgW1NE5kxTbW9QCBXCsSiENSjF+yiECqFCqBCKyCT41hSROdNU2xsUQoVwLAphDUrxPgqhQqgQKoQiMgm+NUVk7mzKbMhAcqJwb+wCVf6Tdfr+8OSTEaw7yBNhHdHnRbiEI68q4JGPiRx1VKQxz5yc55QI7fFnmbyqPO8jj0TK8yP77Rc544wIj5zmee+9pU5Db65KOS7C1Vyxb/hws9pnPHWNLgZ4GPggETyxIEwbj+hXv1rqNMQd5DVDJhfgvshll0VQucLTUE+j+Ibj4VAQFZT1/X1xGRBRKAFu0jXXRPrqhaAzxgthgGpivJs394IjY0RYRxQPJeYKXgojgkxirrAvjBcXCdXENWNyMLHYF0uw4meID384grVt8SAhkNjbb4/g/uK8550XwXqttUluC+bq9NMjuKo0TxanIjJf+JJM2DthbxHZI6I0VwgVwklzpRAqhAqhQqgQisiSw5dkwt4Je3dpa4wp2eMdRVYLUZorhArhpLlSCBVChVAhVAhFZMnhSzJh74S9u7Q1xpTs8Y4iq4UozRVChXDSXCmECqFCqBAqhCKy5PAlmbB3wt6Tibf25I11KzqgSWQtEaW5QqgQTporhVAhVAgVQoVQRJYcviQT9k7YuwtqjJ1v8HGfJ30QWZtgIc1NmyJNHf+JTDrANqGq0ugTiH1Hf4cDLOvTPfCiX4hX19mypdSBTJZyeeaROg8+WOrAtXjNNITsnPZILy0fyzxVpz+x69ZFCK5qHRbSzCH0FaicmDkvc06E8/x4HTj85ZdHGosLmpVg35yJxwxTd9FFkfvvj/DIFH5cVZzoN36j1GmmLjqjNqU/oOqFP6DKR00Mx0PxjRIZ/nDDDRHU4rgMFP24DIgKnAcOAFHBka+8MoIhwLXQihGhFeuI9o0XA8Ryl+efH8H9hVtiPU/chf7SoP/jf0SwL44MPe4/DDBA/AyBycHwMd6+aV99dQRDqJ/8bYHw45pxZJwXV5X7ssAUkfmCNztg74S9u+x4BS/8tfNBZG2iECqECqFCuD2oxRVChVAhFJG5gDc7YO+EvbvseAXHV4Cm+uvwWWQNohAqhAqhQrg9qMUVQoVQIRSRuYA3O2DvhL277HgFT/w6MGxvP4isTRRChVAhVAi3B7W4QqgQKoQiMhfwZgfsnbB3w47X7pjPo69jWzsfRNYmCqFCqBAqhNuDWlwhVAgVQhGZC3izA/ZO2Lthx2t39+ddL2JuGTbWrcNX9BFZcxydOTBTLslkIZu5445Sp+G2OljTbiHSLsopGXBrHZb1PFQMAaUpPK05FGYgbTklFitYopxG2dMQMnnooaXO8I/UCOoiTAy3u/xRnUsuKXWaAUIXN2fCD3/0o1Ln4YcjGD7AEBCsWFnKTZngkEMiGNHzn1/qgJNOisAeKd6/EWn+FmLqUJmzkEXlCsmBIEFjYFNoxaH6xTeCI0NEMSQYAlYoxZEhV3g4UPRDY/DvCEaEI/fXXMXkYOr6VoOLhE3hRPBSzAYGiGnHibDvTBeJyZnpIcSh0IpD4YlFsOgo/nLwiwaChxCPGYKfIbKVBaaIzBe+gEVk3iiEVRRChXBAIYwohNO7lkJYp5VAhVBEEr6ARWTeKIRVFEKFcEAhjCiE07uWQlinlUCFUEQSvoBFZN4ohFUUQoVwQCGMKITTu5ZCWKeVQIVQRBK+gEVk3iiEVRRChXBAIYwohNO7lkJYp5VAhVBEEr6ARWTO9GticngEZQD06cwzIzPR1NMXRHJtTCpQFv1NayguW3MRTrRedllkIbsIX8KCf6WcnAlw3sZqQJwIushlRWlxodY472mnRRpiRdZmaVD8lACZ3JTpcdddkVJuqdOctw+WBo3ZwKGuuy4C1+jfQQ6Qq7nmXUB5DSNClY9VGVH1wnkwBjgAzOSCCyJYDPP9749A+bD8Iyr1WlpubpynrxOo47EEKyYHrf3FMGEXEBV0xlV96lORvrZhX/zshAFiRLiDOC+CmcRdQCsmB0NAMBvYF08dToR/+3DN9YOxLZgreCla8YhiYvsPYV4Gi1MRmS98hYrInGk0psvhCqFCOKAQTryDHKBCWEchVAiH1A/GtmCuFEKRfQO+QkVkzjQa0+VwhVAhHFAIJ95BDlAhrKMQKoRD6gdjWzBXCqHIvgFfoSIyZxqN6XK4QqgQDiiEE+8gB6gQ1lEIFcIh9YOxLZgrhVBk34CvUBGZM43GdDlcIVQIBxTCiXeQA1QI6yiECuGQ+sHYFsyVQiiyb8BXqIjMnSiRH3mk1EE1AmH4xS8iZf8IOmNVRqyNyYp5vwhqcajXD34QKc/JlC11oKm4SBwZrZAcDqE8mYECPVaHU1fekQmdaNQ6LuOpp0odLsJJFfl+JpwWSk+3LB+r88wzpc5BB0U2bozgpwTMRuP/uV5rjhc3BcFN4WXwpmA2ns30b2hMHYKran4suCWC4hvaBrvAHwMqZtTikA2oJvSpbyYIqm0EnTFAdMYQ4JYwXihB34jgAHfeGUErrgqtsEfMFYKLRK6/PoJ/ZHGPkNtui+BR6d8FdMYAYel4zNAZ8ow7CF3EoTBXeDawuGs/2Bd3H384mOfcl8WpiMyX0uV/dWHvRbCjlhPZR1EIJxbuaFUIFUKFcGfgHn0VwQDRWSFUCIe01tcJ9lUIRVYtpQsVMGHvRbCjluuxYAeR1YtCOLFwR6tCqBAqhDsD9+irCAaIzgqhQjiktb5OsK9CKLJqKV2ogAl7L4IdtVyPBTuIrF4UwomFO1oVQoVQIdwZuEdfRTBAdFYIFcIhrfV1gn0VQpFVS+lCBUzYu8uOam1nqTBsqal7YmO7ZdJGkdWIQjixcEerQqgQKoQ7A/foqwgGiM4KoUI4pLW+TrCvQiiyaildqIAJe3cZ1QZjv+Lz0Kf+Omn72K8iqxiU9WV9hkSl3ixoGa1nnFHqHH54pPGWAEURvAXnfeKJSOsMHX8oR5dIOTuzuc6995Y6ADbFa6ZC3FinrzGNXXyyzkMPlToNYWIPPFDq8Ib+VqnDIaS0Ez4M99XBXTj77MgPfxhpuL8O72C5ow7milOXvx0873mRZnXTTXWOPLLUaYj7+/DDpQ7n+cMfjvRXobz22ghqcex7/vkRrJOLpSOvuCKC4ht2gaIfzoO/WBTuMCJ0huNBctB6++0RuAckB1aDfdEZXgp5hh/2PfyrX41gROiM4Ko++tEIWjEiDAHBZeAOXnJJBJ1xIgTijSPjDkL4v/a1CH4rgg8j/eFjYvPhZ3EqIvOFr9CECpiwd5cddcK0XweG7ZM6jOi3iqwmFEKFcHcUQoVQIRxFIayDEyEKoYjMCF+hCRUwYe8uO+qEqb421QU7DFvabiKrHoVQIdwdhVAhVAhHUQjr4ESIQigiM8JXaEIFTNi7y446YeGvs24f+1VkFaMQKoS7oxAqhArhKAphHZwIUQhFZEb4Ck2ogAl7N+yoDcZ8Hn0dtuDzpD7Ddnytu4msehRChXB3FEKFUCEcRSGsgxMhCqGIzAhfoQkVMGHvhh21wZjPw5asIrh99Lnd2G6pt4usOuA8d9dpauLQCVjc009HSvlC5KhS5+CDI30zOeCAUgfLmV5+eQTahtKcSkCiM9r6Mvnoo6UOjAi1aCnnRg4sdSCTpWyo04w3dLG63u3gIuELuN3YtxyQ6U4OWhun7XUu5YI6mzaVOuVlETwquCmYjQMPLHWa8V4eObhEcvioVAHWeu3/HMABwpdgNShkYVNY7xG6iNYvfjGCSh1Wg2CRxv5SqAgeuyuvjMAQoLgYAq4ZRtT3NJwIf5Po3G/FZeAe3XBDBM6DqYN4Y/g41Ec+EkFnzAaOjMcMR8aIcCJIO34OwHlx93GRUGucFw/wVVdF8KeBZ2Ome5SHYnEqIvOF71QRmTsKYQ1EJVAIO5ODVoVQIVQIFUKFUESmge9UEZk7CmENRCVQCDuTg1aFUCFUCBVChVBEpoHvVBGZOwphDUQlUAg7k4NWhVAhVAgVQoVQRKaB71QRmTsKYQ1EJVAIO5ODVoVQIVQIFUKFUESmge9UEZkzEAYsd0kDTMlZwAGy8y9+ESnPzeBEuaIjKhmU1zTAlKs+HH4uO7l5c4TKlxdZyhOZmBxcc6N80RnFGAb47LOlDm05h1DKZXUaqzkvQgOM9TyxAu0550RwZGjbccdFSrmtDlZhBKhF8XMADoWHEPUkBkiZPDwCmdyyJTITmLpf/jJCQ0DVe3OaCR5K1OJYCxS1eD9YwRLVNmwKkgNDwBCwRiWEAZoKe8QAcc3YF8PH1KEV/6zgRNgXQWcs39p3S0wOxouHARqDVTehfOiMy8Atw3nRGT9a4P5iXWDclPYXgToYII6MuULn/u3GxEIIcRl5IhanIjJf+NYUkTlDI1IIFUKFcEcUQoVwYtBZIazTSmAdDFAhFBGFUGTZoREphAqhQrgjCqFCODHorBDWaSWwDgaoEIqIQiiy7NCIFEKFUCHcEYVQIZwYdFYI67QSWAcDVAhFRCEUWXZoRAqhQqgQ7ohCqBBODDorhHVaCayDASqEIqIQiqwAQkVKeV0dVswvyuS+6Mx9uRjmPRlcRlT5aEWtghM99FCkEaQAQthedp1mhdKP1MGhYERYGvTkkyMY4IMPljoAkoPOl1wSaeR5Sya4555IQ9oj+UUdTN1RR0XK8zK8+3hU3pIBYctQr1J+XofyzPPGrxI4FPyQUgeOyByeAaiJIRtXXBGBxqDq7RfBkDo4APZFK6pt5IMfjOBEcHro04UXRlD0Y7xwy74SQCcwsdCndvY6s4H1l7/ylQiOjBFhNtAZC6VivLffHoHj4Xbjmj/+8UhfrrAvlgbtyyQWpMUQ+vcIh8IAsS8645bhduNQeRdYnIrIfOFrMflMF/aeha3b/0OIiGwHNbFCODEKoUKoEI6PQqgQDlEIRWRG+FpMPrCOSAcAAEkYSURBVNOFvWdh60JCuGAHkTUDamKFcGIUQoVQIRwfhVAhHKIQisiM8LWYfKYLe8/C1oV8b8EOImsG1MQK4cQohAqhQjg+CqFCOEQhFJEZ4Wsx+UwX9l4IVGtjt0/aMmmjyBoANbFCODEKoUKoEI6PQqgQDlEIRWRG+FpMPtOFvbuMKrSxn3d3qr5O2j72q8iq5oQI1hE9AMtORgEN9ygvyGSlXspNkVxlFDUDlqxEgVGOznDB0tCJxuLAXXV+8pNSB0v64VBwnp/9LFLKyZF1pQ72baz1kgwE6ZuRbdpTJ+9RM/yHM7GOaClnZ36WgT49mQlOOinS7BtwNjje2BeK2+wbUocT4YaWckadhQ51eZ2mc95ujHe/EsEAr7km0tpIHSxB+6EPRa69NnL11ZEbboigvIaZoNrGSpKo47HcJTrDl/rOA6tBHY8j41A4EZwHJ0IrzotDYSVcHKo/BFzzzbmQJuQZ44UBYulXeClGhDuIq0Jn3H14OM6LB2kmLe9fJGwZv5XASzFX/bS3qQqLUxGZL/muJjvNbwLs3WVKo5skhKDfKrK6UAgVQoVQIVQIFUKFUESWh3xXk53mNwH27tIRwtF/MBxoOwxb2m4iawCFUCFUCBVChVAhVAhFZHnIdzXZaX4TYO8uULhJ4rfg9rFfRVY1CqFCqBAqhAqhQqgQisjykO9qstP8JsDeDbW21f9ZD58n9Rm242vdTWQNoBAqhAqhQqgQKoQKoYgsD/muJjvNbwLs3dBKXU27ffS53dhuqbeLrHa+Xmd40Ec8+mipU8qmTNS1XN6z3JJ5vM4RR5Q6jRGFmWzcWOrQWtM8sTgkCnfU3o0C4ZqDM8+MYK4aQ+hpDMqeUv4xAg9P00Z9xdlYn+Fqru+og6VQAZYzpcaUDZlUoCNLJDs/+WSpc+ihER4KoVyltfInjBPrPPtsqVPKOZH8ZWHLlkgzG/m3gLuwfwYnyvVpWYujWkURjNuPWhzLP952WwRuiSOjM67q87lmI6wG54Wn9R0AvgRvgYrgIiEMfRXBkbEvFjvFnyj2RSBImA3M1Z13RjDP2Bcj6q8Uis6YWASPWf+5anev005IHRwKwcPw4Q9H8NT10//pBCf67/+9DotTEZkvRUSWG4VQIVQIFUKFUCGc/Fy1u9dpJ6ROK4F1FEIRUQhFVgAKoUKoECqECqFCOPm5anev005InVYC6yiEIqIQiqwAFEKFUCFUCBVChXDyc9XuXqedkDqtBNZRCEVEIRRZASiECqFCqBAqhArh5Oeq3b1OOyF1WgmsoxCKiEIosvJo6u/JQQlx+eWRUh6oA1+CTf3yl6UO1z4tn8iE5HznO6VOn69/PbLN8uo0UvdYJIUBsoF9n3oq0qz2mZOZOtF0DuM9/fRS5557IrzmpBHRG+s0ww+OPjoC8W7uwsmZZzNfzsRllINLHTwqmBzIZDMESOyg+tuDI+OmHHhgqVOel0mg1jgyinzefdwVLDsJb0ERDNlAtQ1hQKWOsh6rMvbLerRi3/4aldgXwW82sFaU9bgqSA5mElOHzpgNHBlBZ1wVToTW/pqrmI3+/cWJIIT92cCJMM/9aUfQGUfGQ4jh48nBiLB6LWYDdwFC2J+N3JfFqYjMF75TRWS5yVK1G4VQIVQIRyiECuHu4ERoVQgVQhFJ+E4VkeUmS9VuFEKFUCEcoRAqhLuDE6FVIVQIRSThO1VElpssVbtRCBVChXCEQqgQ7g5OhFaFUCEUkYTvVBFZbrJU7UYhVAgVwhEKoUK4OzgRWhVChVBEEr5TRWTerIs88UTkZS+LAKycidL8xBMjaMVakVQgqlesjQkRPf74CGpxGkKeF50xQCpBrmDJ1hIKhIU04QA//Wmpc9JJkR/+MILV8h58MFLK/XWo1nnNGC/uYL8Vz8bPfx5ZiFB63BQ+G7S4S+rwUQFHRTCickipg8vAc0UOimBy6HhcVjRHlP7PMhfXgXU1P/ShCFwL+yIor1EiY7lLaOodd0RQ5aOs76sIgjoeVT5OhFaoCA6FDDM8CqwGEovz4kS4DAQ3BWbS96V++vtu2hS59toIbiguEq1YzhS/Snz0oxEMcPPmyPXXR667LoIT4dlAZ8gkjozHG/KM8WZnFqciMl/4wk0u7sLeS8H2gkFk30IhrMAAqXwKoUKoECqECqFCKCJLCl+4CRUwYe+lYHvB0GXBDiKrDYWwAgOk8imECqFCqBAqhAqhiCwpfOEmVMCEvZeC7QVDlwU7iKw2FMIKDJDKpxAqhAqhQqgQKoQisqTwhZtQARP27sKqYIqmdmO7ZdJGkdWDQliBAVL5FEKFUCFUCBVChVBElhS+cBMqYMLeXXYWA7N8Hn3A10nbx34VWRXcXQeLJaJIGP2RDKAIXqhEjrIerY88Uuo0J9qQiWtGlY81SKuR7iDXity4McIhHJtJ9eKRX5h5SWZ9JsG0l7KpziWXlDrr1kWgfBTgFH5cRrMw7EfqPPxwqbPQw3B2JOcZV3XMMREU6hxC0gjhDyJHlDqYuuaaY57LtjteJxd3xWU8+mikeTZi3dSTTy51OIQbboigckXRf955EWgMJAeVOg6F23/VVZFLL43gyFCgvuNh38/nSpK33x6BeqEzzBOtcAAE14xDQXIwV1/9agRihsvATYGo4KZA+HHNmA3si78cLFgKLUdwkRB+DBBX1f91oO/heFTQivOiFQPETxgYEa4ZP47kbLA4FZH5gjcsoAIm7N1lx6t/zNdJ28Gk/qDfKrIyUQgVQoVQIVQIFUKFUESWB7xhARUwYe8uO179Y75O2j76XNN2GLa03URWEQqhQqgQKoQKoUKoEIrI8oA3LKACJuzdZcerf8zXpdo+9qvIqkAhVAgVQoVQIVQIFUIRWR7whgVUwIS9G3a87nd/Hr5O+Xn0obMdX+tuIqsIhVAhVAgVQoVQIVQIRWR5wBsWUAET9m7Y8brf/TnLgN1Maqq3DNun7CayeglPY+Warf3CvTHAyzLZul+u/5kaA20r5fI6p55a6ixEeguK/pQrnhcXSX94NPN4neFfiuHfiyDPi6vCSnvHHRcp5ZE6uOa77oo0lxGzAUE488wI5GrLlghaIUhYKBUrduJE0GMsnYi6DuPFEH7xiwiWYKVa51KoXPv0ORk+SOGWuAzA3x1Q18IBUBNDrlB8wz1wKCgQgkod7gFtw764SNwkVPm4ZggwzgvXwvBhCLgMBIaAE8GX7rwz0r8MLHeJztAntGLlTNwFLMLZX2MWSg9P66/niRFh334rpg7Pc/9QmA1IHTwci53C8HEZODImJ/9JYnEqIvOFr8m9xpgCTETGoRAqhAqhQqgQKoSTLQ6tCqGILA6+JvcaYwowERmHQqgQKoQKoUKoEE62OLQqhCKyOPia3GuMKcBEZBwKoUKoECqECqFCONni0KoQisji4GtSRJYbhVAhVAgVQoVQIZxscWhVCEVkcfA1KSJzhs5DybkvE0AIX/GKCIzoqadKHXJ4Ji8DdTwKd/gDrgrF2AJOm2tjQp9gJtw3j7x7aDtALdrMc9jF00+XOpycdK2yTdSrnH56pJRnMg/XaSbn3jrnnFPqYDawBulJJ0XKwZmyoQ5+aGh+dwi5KuWWOvS0F0Ugz5grPO14cjDPcGnc/VJOyPw8g4chwien71p4dFBPo4BGTQwTg3vgvDgyLgOtqPJxIlTqOBTKehwZ44Xy4URwD5z3wx+O4FB4VnDes8+OQK1h/HiwLrssgn0xXlgrRoRrxv3FDcU847xQXPgwHB5rCuMXHYgoFmjFj0MYIO4ggruAO4hrxlxhYnFk+GGOl8WpiMyXIiLLi0IYpblCqBDuikIYQatCqBAqhCKyRBQRWV4UwijNFUKFcFcUwghaFUKFUCEUkSWiiMjyohBGaa4QKoS7ohBG0KoQKoQKoYgsEUVElheFMEpzhVAh3BWFMIJWhVAhVAhFZIkoIrK8NAX0azuBEjSFe8Cqt9yc2Rg5otQ566xIc968sLQ48OijEVwVL3IwtFEAT4RC/+QMNSADMNXR+bWvLXXIAVihNDkw0qhX+BJW+4R44yKffbbUKa/I5DqxJFub+xvDP/bYUqcclllgYnutzWxsyIAY/kMPlTr9IfBIaEWpiqoXZS6CFTs/9rHIDTdEUPSjrMd5+6qJ5UzhD7gqnBeSA4vrO+2ll0ZwXhwK2oarwhCgqegMx8OKnZhnXBUmFst7wuKuvTYCI7ryysjN6VoIDoV9N2+O4ES4+5hJBIfCbGBlVOT88yOYWDyiF10UgQ/jvLiDeK4++ME6LE5FZL7wJZm8owt7i8geoBAqhAqhQqgQKoQKoYgsF3xJJlTAhL2noHllL7AdHfAVTOossqJRCBVChVAhVAgVQoVQRJYLviQTKmDC3lOw4zU95uuk7fWWduNoOzdN7iyyElEIFUKFUCFUCBVChVBElgu+JBMqYMLeU7DjNT3mK7Zjy5TdsKVtElmJKIQKoUKoECqECqFCKCLLBV+SCRUwYe8p2PGaHvMV27Flym7Y0jaJrEyi6GeJjLL+cCx3CR7JoCa+JAPQ+rnMbRlwYybOyxGBan3O7UmG+n7EEUeUOrS4/UoEw98fqonJiXDp16Mz2ZlOm/RbS/lFBsSJuE5sitmRR0ZOwqKjtLjuU0c+kukNf4Hx4jLS8FHzg0MOiTQ8VgdPDpZd5JODSh1rNqLKhz3CPfADT98Pr7oqAvVCUPRDvXCRWJQSl4F9r78+giFcfXUEbgnXgk5gJjF8JA2Bq8piRFgME3OFm9K/DAwf84xg+JDYa66JwDwxBNwyqBemHSPCNWNEkHY83v25gh7DAPEneuGFEcwGxovk3xGLUxGZL3yjJlTAhL2nAO/oenvVi1uGz/1u2NI2iaxMuqW5QlihECqECqFCuD0KoUIoIksH36gJFTBh7ynYOk7z8Blb0LSYryIrk25prhBWKIQKoUKoEG6PQqgQisjSwTdqQgVM2HsKtk4QNmyvt+RbfTtjuw1fQd0qsjLpluYKYYVCqBAqhArh9iiECqGILB18oyZUwIS9p2Br42/97fi8yK8iK5Nuaa4QViiECqFCqBBuj0KoEIrI0sE3akIFTNh7CrY2hjbagnc3WsGkDgt2FlmRHBFBPY3aDLV4k7szIByA5XVeRilP1HnggVIHJUQpF9Q5/fRShxeZDrDtX5I66IzzNjxQB8uZNuRllHvrHHdcqQPe+MYIOPTQSCNXcd7DDit1cLupfLxmcHImaEYUd78cXCLwtMwCjleeyvQ44IAIfuDYf/8I4SMakxPvkK1buQRreajOKaeUOiz6sd4jqu1+HQ/XgonBECCEqPJhF33VxL5YSRKtWP0SFgfngZlgXxwZV4WJhZjhyLhmjBezgWnHVaEVdxDjxWVgRHgYcBk4MpwHw8eTA7nCsqJ///cRjAgLtKIV1wy1xsTiicUA8Yjin37cMqx92rfl/CmBxamIzBe+cEVk3iiECqFCuCMKYQQFNP4tUAjrKIR1FEIRmRG+cEVk3iiECqFCuCMKYQQFNP4tUAjrKIR1FEIRmRG+cJcOvJ23+v90U2Q8CqFCqBDuiEIYQQGNfwsUwjoKYR2FUERmhC9cEZk3CqFCqBDuiEIYQQGNfwsUwjoKYR2FUERmhC9cEZkzqJEWUK91mfJ4hK0Ba3HAfaPaPvroUgfOQwWCbByRmUk28lA40ZlnRqBt990X6UN/eFEGi1KmiOJQMBMIMODUkbgLbMxWHIqXUTbVgcQCiBknB/f3OREUn7gMLt+aQ8DDgM643c3kRH7601KHpr1fButbIvAHlMhohU70a3HoBCpm1NNY0RGXgcUhUaln8U3ZQGt/tU8c+T3vieAiMTnwJaz9ChHFTEI2MHwcuX9eHArTjkA1ofRnnRU5//wI7i/ufl/psVJo3wBxVbfcEsFbpH9ePHW43eeeG4Hx4g5i2vFc5VWxOBWR+cI6QETmjEKoEO6eOgLP6bXiULwMhVAhVAhHUQg751UIRfZJWAeIyJxRCBXC3VNH4Dm9VhyKl6EQKoQK4SgKYee8CqHIPgnrABGZMwqhQrh76gg8p9eKQ/EyFEKFUCEcRSHsnFchFNknYR0gInNGIVQId08dgef0WnEoXoZCqBAqhKMohJ3zKoQi+ySsA0RkzqBiXqDqpbYtQghTVM4+OzIjH6kDM0F9BTOBezRLVn4swgGGp1Gu0jzLAZlyUx2UpjATWDpvSrmsDh0+wZGx1usdd0QajoukiTU8VgfnxV3grjzy5jrr1pU6nPacnDPOKHWay4BpI/Fc4Robt8zOeFQ4ogSF+6VZi0MJ0Bm/6KAzDoU/BlhNf3VTrN6L8UMJUKlDRZD3vS8CA8TamBgC1qhEMAR4GlqhIvCWL3whgkNh6jAb+JuEqEBi8U8w5hnDh1qjFUPAefHkYLFT3AXYFDqfd14EJ4LwI33VRCvuwuc+F4GIQiYxOfkQsjgVkfnC12Ly6i7sLSJ7gEKoECqEE6IQVlEIFUKFUET2DnwtJlTAhL1FZA9QCBVChXBCFMIqCqFCqBCKyN6Br8WECpiwt4jsAQqhQqgQTohCWEUhVAgVQhHZO/C1mFABE/busnX7ogY7S99hS/11yj4ia43hKR+hECqECqFCqBDSphRChVBE9hp8LSZUwIS9u4xq3fpr+7ntUzcN20XWMs88EwHUp1ws8bjjInj/ct9yS52vf73UwcKSXGeyPJGBIG2M9GvxhKtfdg2QO+dswLXK/pFzzomQPC90seGSTPghFOiggyKl3JbBTIa1ohVV/SOPRKheOaLRP68DC0xsqvWRR0YaPlHntttKneaG5i8aOcBGNeMisXBoI+03ZnCiBEXwF78YQU2MIrgvGyj60QqNQefLLov05QoiiquCa/Xt8YorIhdfHIEgwVtwzfDhz38+8nd/F7nggghOhMvANWNEWDnzM5+JwFphUzgRDoV/VbGsKNZcxYjw7wjuPmyqv+YqRPTKKyMQ0S99KYLZwKEwfAQ3BU8sJhYnwh9OPsAsTkVkvvC1mFABE/buAqMbK3jT9BFZ4yiECmEVhVAhVAgVQoVQRPYufC0mVMCEvbu0dleVIru3VO38KrJPoBAqhFUUQoVQIVQIFUIR2bvwtZhQARP27tKxu6EJfTq7iKxZFEKFsIpCqBAqhAqhQigiexe+FhMqYMLeDbXRdWRv+Nz2mdQksmZRCBXCKgqhQqgQKoQKoYjsXfhaTKiACXs31BbXGl1ViuzeUrXv3II+Imsc1PHD38CIiy4qdZ54IoKaGMGhuOho2lQDzCTgoXKl0KZSB1Hl01pTRSAbjT4FOFT/MjA5sEe00rUOj6AVtRn0mM7zogwH2BvvscdGMHV90+a0J7zIPDJbZwFz1ajmY3UeeqjUAbi/WK8VJ8INZbUN1YZ7YIFHdIZNwQBhcTgvWlFef/rTEegEAveAmOGhhMWhyr/11gjKengLVuyEpsJbMHUYINaovPzyXrAIJ8aLIUCPIfz4dQAeDgHGAOFLuCnQRdxuXBV+ssJTB+HHVeGpw2OGq8LwsS8GiGcSjwqmDvKMFUpzCCxORWS+8J0qIstLv3JVCBXCSeNVCOsohAqhQqgQisiU8J0qIstLv3JVCBXCSeNVCOsohAqhQqgQisiU8J0qIstLv3JVCBXCSeNVCOsohAqhQqgQisiU8J0qIstLv3JVCBXCSeNVCOsohAqhQqgQisiU8J0qInMGi0OiNG+q7RMyUTGjSECgBGhFRfHkkxHw8MMRVNvl6Mz6CPbFmpyoNnHN554bwRBoj0jXptB69tmlzsEHRzjeBKX4D38YKeWOOphnnKiUZzJxkVu2lDqo6uk8SaPHcWTYFO4gpx2k8eIynn661MGaqzjygw9GZgLn7T/PrFwR6BPqWlTMZ54ZaVWtDqp8HOp974vAeWBE2Le/VCYk5+abI1h2EueF87z//REYAn7Bgi4imHaMCIG34NHBkeGHkHbMFTpDYjHtGCAkFrcbS6FCn7AvZqN/Q3FkzAbcsp/3vreXs87qBf9A9+cqh8DiVETmC1+LIjJnFEKFUCFUCBVCTjtGhCiECqGILB18LYrInFEIFUKFUCFUCDntGBGiECqEIrJ08LUoInNGIVQIFUKFUCHktGNEiEKoEIrI0sHXoojMGYVQIVQIFUKFkNOOESEKoUIoIksHX4siMmceeyzSEJU6VOSZZyIoA2AXkKtStmQC7Isj46pQfJdtJlPl8MMj2BcnQuEO51ngvN0jA7SidIGWY9oxG41s3J+Jq4Iv/PKXkRe9KLJN3OrMJkgvjOB3Bwy/eTZ684zxHnZY5NRTI3gYmrnqgatq9r2gDurnhg2ZBD+HoFLHoXH7b7opgp803v3uCH5pwHnhPB/4QATFN5boRLWNQ8E8cV4MEMtOwh4vuCBy/vkR6BO0DTIJe0RnXBVGhPNi+K1t1oF6Ybz4RQcnwhCgQDgR5qq9kjrnndcLDoXxIrB0zCSOjOcZzwZ+DYF5fulLERwKf0dYRjWPzOJUROYLX4vJkV3YeynYUdSJ7EsohHVQ9CuECqFCqBBuj0KoEIrIXoOvxYQKmLD3UrCjqBPZl1AI66DoVwgVQoVQIdwehVAhFJG9Bl+LCRUwYe+lYEdRJ7IvoRDWQdGvECqECqFCuD0KoUIoInsNvhYTKmDC3l12VGs7///5D1sG0K3Tod5ebxRZrSiEdVD0K4QKoUKoEG6PQqgQisheg6/FhAqYsHeXUSEx9is+j9046fPog8iq5q46eKWW8nAdGCCEoXG8O+qM/ngGmnUmY8FSGBFUpFk5M/yhlFvroI5F5wMPLHX6KlLP2jZwkc2KrHEoSF1DdG4mJ1q56ywnWrcuUspNme6JDsqUb2XiUM2JHozsV+pAvZrhb84EzT36eh3co+bJ6dF/NprWDXWa1uR5mVtuiWBxSAjDxz8eueqqyObNESzgiRL585+PoDMUCAaIKh+tEDO0ospHZwwfP5ZgNVvIFczz05+O4DJgvNAYnGim8eIu4CLhPOiMVVXRGSfC5PzN30TQGZNz+ukRXCT2xWOGzjONF0dGZ4wIK7JiX9wjPLE4MoafnVmcish84VsyoQIm7N0Ftdykr+2H/naRNYBCOLHoxzXXs1YUQoVQIZxSkNCqECqEQ9BZIRTZJ+FbMqECJuzdBbUcSoihtf3Q3y6yBlAIJxb9uOZ61opCqBAqhFMKEloVQoVwCDorhCL7JHxLJlTAhL27oJZrS7sRw/ZJ/SftKLJ6UQgnFv245nrWikKoECqEUwoSWhVChXAIOiuEIvskfEsmVMCEvRvq+g213K7KYffX9sM0n0cfRFY1CuHEoh/XXM9aUQgVQoVwSkFCq0KoEA5BZ4VQZJ+Eb8mECpiwd0Ndv7W1XJYQuzf2O9Tb640iq5Z1maT6Kxjz0PerXppJ90RQAnTmoRK25r6wiyOOiMAeGxUJmtbYF5UM1BoX+cY3Rsr6CNzyjjsiDz8cAbhIGBGknVPXFUJ2Xh9ha9Is0dmXq3Mi63uT04Ah9EbUtPY644ZivVY8wPjDwb582lExw4jgHiiRUYvDW1AT48io8rEMI1bdxPONa0a1jRPhqlDHY3ZwVRdfHLn++ggMAUuSwhBwZEwsjoyJxbRj3/e+N4LzIpgcTB0uEncBnbFQKq4K63miFSfCDe0LMC4D047fLPoTi8npr/WKu4AVWfFcnXJKBEvs5q8SLE5FZL7ghSsic2ddz9NQ16K1qeMDGkL3RCyRszMPlbA194UgKYQK4Z51xg1VCBXC3VEIFUIRWQR44YrI3FnX8zTUtWht6viAhtA9EUvk7MxDJWzNfSFICqFCuGedcUMVQoVwdxRChVBEFgFeuCIyd9b1PA11LVqbOj6gIXRPxBI5O/NQCVtzXwiSQqgQ7lln3FCFUCHcHYVQIRSRRYAXrojMnXU9T0Ndi9amjg9oCN0TsUTOzjxUwtbcF4KkECqEe9YZN1QhVAh3RyFUCEVkEeCFKyJzJ9d7vPXWCNyjsYtYGhQHfuSRCKq+BTg0csIJkVJem1k68ryl3FbnuONKnQVY1xPg2TgyMz9yadAF+FmmT6xeW8pPMo9mADrfm+l3Ru6os3FjqTMbvN0bI4eUyIEZFNBZqpZPfSqC1s9+NoJWHBneAn7jNyJ43F/96l7Q+ZWvjLzqVb28+MWRP/mTyNvfHsFPKSeeGPnjP478038aAX/0R5GXvzzy+78fedObIm94QwSzcfzxkT/4gwg6v/a1vWDf170u8prXRC68MAIFwm8Y0MXzz49cdFHk3e+OYEVW5JxzIjgyzou1Xt/3vsg73hF561sj73xn5G1vi7z+9ZENGyL5t8DidJn4XyL7Kvz3WUTmjUJYoxAGCuHU8HYrhAqhQqgQzgZrZJF9Bv77LCLzRiGsUQgDhXBqeLsVQoVQIVQIZ4M1ssg+A/99FpF5oxDWKISBQjg1vN0KoUKoECqEs8EaWWSfgf8+i8i8UQhrFMJAIZwa3m6FUCFUCBXC2WCNLLLPwH+fRWTerM/MRL8I3maMVe6+O1KelyHfygSNW95VB+XWF74QKeXGzM11nnmm1Dn99Mi550Ygz40+balz5JGlzgEHRA4/PFIOzpTXRV5W6vzjP0bKcyJf/nKEC3geUyLlvsypdU46qdTBkn7l2EzZnPl5nWZJ0vszD2Rm4QWZmeg/z3nkdesihxwSmQ3U8Zjot7wl8l/+S+SCCyIooE8+OfLXfx35q7+KoFLH8o9Y4PE734l873u9/MM/RP73/45s2RLZVhnUQWe0fvObEbTiyP0TzZR77om0HTrBZeBQ/RGhFZPzjW9EsC9O9PWvR3BkXCQeJPz7hb9n+DCs9bj87QDGix8L8K85fLiv1v/hP0RwVRkWpyIyX/haBFu7kV20/3MAIyZtF6lYn5mJfgGtECqECuE0KIQdT1MI66BVIVQIRdYEfC2Cjs50mnaB/yEoNq9gcOUj2KliUuuk7SIV6zMz0S+gFUKFUCGcBoWw42kKYR20KoQKociagK9FMNKZsf9tcArTgQ6tRjua8pondZu0XaRifWYm+gW0QqgQKoTToBB2PE0hrINWhVAhFFkT8LUI9poQDv/Zre3T2Vhvb/vUH+rO7b71RmwHbevYHeuN2D62z7BRZIcE1pmJfgGtECqECuE0KIQdT1MI66BVIVQIRdYEfC2CkblsbTI0dYH5DF9rKcLn0Yf68zSd6691H3wd2wf9AZomfZ10wEkbh88is/JEZqaFJcGjmX/MPJK5rM5115U6q4PnZhbFQ3WgqaUcXwcrOOIf01e8IvLJT0aOOCICe3z88Ugpx0VyIU3oA12rPF6nEf4fRZ5fIiQOxcbFsD4zC83wfxrZkOsfnnJK5M/+LIJlGCGTF13UCzrDAPudsRrkxRdHsDQohnDooZFf+7XIQQdF4Na/+quRPocdFoGo4Mj9y+iDvzqY2H33Re69N4JWPBzo/N3vRqBtaEW+/e3It77Vy//9vxFc1Re/GLnxxgiWfkVOPTXykpdEsLhr/5eV3/3dCOwR/MqvRPCrRA6fxamIzBf+/YKRtmQBM5MQ1tTbq15hTfX2sRsndV5we2fj2D4jOk1lipO2H8Z+FZkehXBPUQgVQoVQIVQIFUIRaeDfLxhpSxYwMwnhpM+gbaq3DJ/rr7Nux0bAHrtom8buiG7tduw1bBeZFYVwT1EIFUKFUCFUCBVCEWng3y8YaUsWMHsmhPXXaXRoUuc93r7gxrH0j7bgSdsPIotEIdxTFEKFUCFUCBVChVBEGvj3CzoW02naRUeT6qax1jS2Mz6PPnS2T2qqN9bbW9qj1Z/HHhCf2431dpFZUQj3FIVQIVQIFUKFUCEUkQb+/YIsXZiFaLUHggRNqreP3Thp++jzsLHuM9rS2RfbQdta7zW0DhuHpmF7/bntIFLW5WKJ5bDIK18ZIYdnwHMyi+L+yDqsBpnkapAnnhgp5YTMEoIlOpeQn2QAVjedqfUtmc0ZaPktkW3VWpUzzoiU8onMLBzefa5yDVJYzMaNkRn5ZAbErxJsLLdmQPcuoFTtB0XwscdG0Po7vxP5N/8mgn3//M8jf/qnEaxR+c53Rv74jyNYChVH/s//OfK2t0XQ+T3viWCh1De9KYJVKF//+ggWtHz72yOQWBwZ1wxLx1xhYVh0/o//MYKZxAD/9m8jeNz/4i8iODKW2cQinLhH+AM+4YQILvLNb4707+9b3xrBzx/ojKnDs4Hx4lD/6T9F8DBgRPkTBotTEZkvfC2KyJxRCJcOhVAhVAgVQoVQIRSR2eBrUUTmjEK4dCiECqFCqBAqhAqhiMwGX4siMmcUwqVDIVQIFUKFUCFUCEVkNvhaFJE5oxAuHQqhQqgQKoQKoUIoIrPB16KIzJ0fZMCjGdAtc7lwKPhWBvTXL4WogP6+i+G8zCxQYjdGUmLvuisy0/KHi+LIDK95FhbY9/sZcE0GXJeZicU8k7DlmYB4J3AP1LUIOr/mNRH8/gFPQ2mOEhkFNCp1HAqd0fqGN0Re/erI8cdH/vAPI32Nwb4YPgwQA0SwGCakDhaX/sDxIn/0RxG0YuowVzgRgiFgXwQjwvKeyEtfGsEQcAeh1rgLGCA69+8+DoXLwP1F+ofCc5WdWZyKyHzha1FE5o5COD0K4dQssK9CWKEQ1lEIO8EQWgmsoxDWUQhFVjB8LYrI3FEIp0chnJoF9lUIKxTCOgphJxhCK4F1FMI6CqHICoavRRGZOwrh9CiEU7PAvgphhUJYRyHsBENoJbCOQlhHIRRZwfC1KCJzRyGcHoVwahbYVyGsUAjrKISdYAitBNZRCOsohCIrGL4WRWTu9EvzLiz6e5Lzs59F5ic54IjMTMwy3p//PFLKhswS0teYRdzfRfFwBnQFaYHWxXBO5Pmlzv77R8rh/cVO+1xQ55prSp1ycOa44yLr10dQ16I0R/GNAhrpr0KJQ+FEEDNcFYLz4sjo3DdA7ItACXBetOJE6IzzovMrXhH59/8+gjv4+78fednLeoGJITgR9sUy0NgXDxIO1b+/GC9OhB8Ljjkm8s//eeS3fzuCHzguuyxy4YWR88+PvP/9kfe+N3LOORGsT4tDfeADdVicish84Ss02Vq2dsLeIrJHLEIYZhEkhVAhrOgrX791MSiECqFCqBAqhCIrC75Ck471dZoGtm5duM+SMLcTiewNFiEMswiSQqgQVvSVr9+6GBRChVAhVAgVQpGVBV+hycj6xv63QYVQZKlYhDDMIkgKoUJY0Ve+futiUAgVQoVQIVQIRVYWfIUmSyWEWyvqr3XPmmE7muqNaBrR7jVsEVmxLEIYZhEkhVAhrOgrX791MSiECqFCqBAqhCIrC75CkyUUwnZj/bmWt1k/j74On/EVTSIrDqxat2VLZEbOjRyOevqhOg8+WOo8+2zksMMiVC+uM4nFP8+uc8ghpc5PfxrZtCnCE72k1LnvvgiK/sYAH4kcXSI5G0ceWeps2BApz8nkeR99tNRB5fajH0VQuDarbsLinsw8nQE4FFagzYk9pERelin3ZfrGe0LmJxn48OMZgH0BBogjX54B92aSc8+NvO99EdS1f/u3kTPOiHz2s5FvfjPyjW9E7rkngs7/5/9E/uf/jGAl3G2v8zoznai/75e+FLnllsiXvxz56lcjt98ewb533BG5884I9r311gg6o/UrX4ngIpG+t5x8cuTMMyNnnRXByqh/8zcR+NJb3hL58z+P4Mh4zNKmygUXRK68MgLlu/jiyMaNkYsuiuBvATJ52mkR/GlgJjH8XIKVxamIzBe+FpN5CuGwcTHbx34VWdEohAqhQrgL7AsUQoVQIVQIRWTp4WsxWaVCONoyAttFVhwKoUKoEO4C+wKFUCFUCBVCEVl6+FpMVq8QDnSaRFYECqFCqBDuAvsChVAhVAgVQhFZevhaTDrW12kaGOtvYz9v3cFMn0cfFvyKJpEVh0KoECqEu8C+QCFUCBVChVBElh6+FpP2vw3ivxP2GetvYz+PZG9g6ICmemPVZXefzhaRFQvKXPCdTLKuu+rmong0A0OAbDyWwb7QmEsyfVD0/yyzIQLJmQ0MYSbuyYD+/e26Fu8vODGDuZppnkH3qvgwgD/PgK6YLXDkxQDTTrBm4zvfGUFZjzr+7W+PvO1tkb/+60jfPI8/PnL55REU7llPl5NOisBb3v3uCGTjD/8w8sY3Rk49NQLnwVy99a0RtGKRVawFiiOfckoEU/eud0VOPDGC4f/lX0YwdbhI3F8IIfZ9xzsi0DZcM4aPpUFf/OLIq14VOfroyL/7d5Hf/d0IDoXgJyvsi2VUf+/3IuiMVtxQXGR3+VYWpyIyX/haXCY0N9mX6QuDQqgQKoSLRyFUCBVChVBExsPX4jKhEMq+TF8YFEKFUCFcPAqhQqgQKoQiMh6+FpcJhVD2ZfrCoBAqhArh4lEIFUKFUCEUkfHwtSgic6cvDAqhQqgQLh6FUCFUCBVCERkPX4siMnf6RTDUC/RlowtloyuTR2XWZ5LNmyPDEk87F3rieRNI3aEZLBzK1U2fimBp0P0zC3Bq5uw6zWKnN2Y+ETm2RAjufpwIU/fYY6UO1g686qpIM895fw8oES7+uSUTHHpoZP/9I82io2+J7FfqYIDr1pU6szHbeL8ZQV37B38Qgae96U0RKB/UC4KElSSxxDAOhVUZcWSsBomlI7/+9ci990auvjqCpSNxIjxYuEisFHr33ZGPfSyCNYUhSFiDFCujfv/7kW9/O/Ld70awQOtnPhPBsqLXXBP52tci3/pW5HWvi2BVaHTGXCFw2gsvjEBTcVO+970IZqO/uOunPhX5kz+JYOFQXCQCaUdwKCQHyOJUROYLX6kiMncUwgqFUCFUCEdRCBVChVBE5gJfqSIydxTCCoVQIVQIR1EIFUKFUETmAl+pIjJ3FMIKhVAhVAhHUQgVQoVQROYCX6kiMncUwgqFUCFUCEdRCBVChVBE5gJfqSIyd07JfCHT5x2Z0zNvyJwVWb/D5YaUN2WS9ejcJzT1m98sdUq5KTMLLPofzXQ5PLM6uC7TY7/9IqhUZwKexubFAOGfie6+DzwQIYdFOMAvfjFy552Rr3418sEPRrDOJNYCPe+8CBYOhXmi9fzzIxdcEIEQ4qr6533zmyNYRxQqgmA9T5z3t34rctRRkV//9chv/mbkV34lsn595NhjI/11NX/ndyJY3xKHwr5YGxOd/+2/jbzkJREs4PmKV0RyXU1eFc6LI+M3C1wVlvdEcN7XvCaCE+EyMJMYEYJ90Yqn/eUvr8PiVETmC1+ayTsO+HEn7L1olrjwEFklKIRTs04hnIhCqBAqhArhmCiEMplSfjyEbbIvwZdm0rG+TtMA37kLMU2f6cHRlvbgIkuIQjg16xTCiSiECqFCqBCOiUIok1EIZQRfmsnI+sb+t8EphbDztWXBDjOxtEcT2XsohFOzTiGciEKoECqECuGYKIQyGYVQRvClmew9IYx38dQd6u1jNw7bx27p9B86tNsnbRRZKhTCqVmnEE5EIVQIFUKFcEwUQpmMQigj+NJM9pIQ7nwFj/s8duOkz/gw/fYFP4++4gM+i6x4soAePeIDjVztOTzyymT/mVYZXQynZVYhz8mArpgtQIoZmeWZfOMbI1xWFOQ133hjhOU1DCEr1/Kyl0V++7cjr3pVBEU/giOjnoYvoZ6Ga6Gshy+1p64DYUBwKJwXRT+8BXN13HERzDNO1J9nXCRaoTF9T8Nl4GFA5yOOiKAzLuPooyOQyb7jYZ4xXhwZh/rX/zrSH1H/UcGR8cSiMx7R/qHyqlicish84UszWbwQjq0SUTEOX9sP/e1jmdR5qbaLrB4UwhqFcHoUQoVwCA6lECqECqHImoMvzWTxQjjpM0Cf4UN/+0AebHznPd4++lwfWWSVoBDWKITToxAqhENwKIVQIVQIRdYcfGkmSyiE9ddJFeOkDpO2j904qfMeb19wo8hKRSGsUQinRyFUCIfgUAqhQqgQiqw5+NJMOtbXaRpAZTh8RdFYb287dD7jw6QO+LrgAfG13o4+IisbhbBGIZwehVAhHIJDKYQKoUIosubgSzNp/9sg/jthn7YyHLaMrR7xue1Qb5+0cWhCz3qXoQkbh8/42nYWWYUck1kU3eKbvDGzCPrC0JeNRXHT0q2MmnTl6qmnImQvjncxPJDpMfzbOhb2zrlavz4yE5/4RITu0TcTqNcxx0T6jofWvrfgvPAWVNv9IeCaEWhM/8jQCeyLi+zvi8Uwcc3QGEwOjAh3AQPsyzOuqj8EBJ2PPz6CI/e9FAu0YkS4KeiMucJjhkPhMnAX0Nq1OA4fDwPmGVOXF8niVETmC1+TIrJmUQj3HIVwehRChXCCTWFfhbCOQigiywdfkyKyZlEI9xyFcHoUQoVwgk1hX4WwjkIoIssHX5MismZRCPcchXB6FEKFcIJNYV+FsI5CKCLLB1+TIrJmUQj3HIVwehRChXCCTWFfhbCOQigiywdfkyIyd7pylUXwJz8ZWRSzrCR5yy2RvcjzIk8+GZlJNkq5PPNY5t5MAovjCqV5y9AZE9v38EMzz88ckMmbUg7OLIp3RDAikPeoHJXp75ud3/KWSClPZIKHHoo0nJAJUOX+6EcRFtAIql6oCDq3ztAJKmYsK4oFS3FeBIbwmtdEoARYsvKtb41ceWXkve+NXHFF5OKLI6efHnnXuyLnnRdB69lnR97//sjf/E3kqqtmyIc/HPngByMYwjXXRLDvtddGPvShCCbnhht6ufrqyMc/Hrn++shll0VwkeiMfOxjEfwcgvN++tMRHApDuO66CN5PmBwkp53FqYjMF7w0RWT+KIQVCqFCqBAqhAohTEwhFJG9CV6aIjJ/FMIKhVAhVAgVQoUQJqYQisjeBC9NEZk/CmGFQqgQKoQKoUIIE1MIRWRvgpemiMwfhbBCIVQIFUKFUCGEiSmEIrI3wUtTRObP3XU2bix1sGpdeXGmrwTwh7IlAlFBZ6hIOaXOqaeWOgsR+y60NubDdR55pNQpR2TAgRmYCVpBDh93YQGoi9+JcCZTvSCE5cuR1CeSYnbSSZEFHJ7nBZvq8C7sFznuuF6e85wI5yof4HPPjSxEzmRfvHFe5KKLIjAiFNCf/Wzkxhsj6Ax/+OhHI/AHdMahUNbjvAiq/L634KqQvhFBGD71qQj8AZ52ySWRSy+NYPhovemmyAc+EMF4cZH/7b9FMFcY7+bNvbTTVQeqidnAENAZF4nZ6N8j6GL/2cBzBanrHwp3EIoLpYc95mWwOBWR+cKXJvlxN0vPmJXG58L4Rc5F5oJCWKMQKoQKoUKoECqEIjI/+NIkHevrNO0k/helptOtKbvNxILHXLCDyF5FIaxRCBVChVAhVAgVQhGZH3xpkpH1/bjJ0NQDojWNd03TZ1YWPOaCHUT2KgphjUKoECqECqFCqBCKyPzgS5MM7ocMTT1a0aq37PoPh9sZuxHbh8/4OmmXukP9AT2Hr50tInsVhbBGIVQIFUKFUCFUCEVkfvClSQb3Q4amHq1QQbpm+jz6gK+T+tdM6jD24NMcUGSOUCc27nmOLpFyWuaNkReWSLmxzn77lTqEJzolcmSpQ9mA8UKQ+kU/le+WDLgp02V9Zja+kElSzFCMbffYOuR1dR59tNS59dbIQgYYYE3Km7JwbZ7JX0YOKhHAe3RrhK2PRJ4fS7CefHKkuaG5b8pzKXdFLrwwAiGEA2C9xwsuiJx/fgSqCVH5r/81gtuP9R5xZPxogZUz4Q9wAASdUdZjNtCKKn/Tpgi8BXaB4FCYWLgHbgqU7yMfiUBTL788gpmEtcK14GmwKSgfggH+3d9F0IqLxIkwfDxI+M0CM4m5wl3AXMH/cSIMEM8Gniv84eSfBotTEZkv+apuGdwPGZp6tDY11sH2xvaxGyd1rrdP6iOyTLD43rjnoaedphAqhGNRCBVChVAhVAhF9h3yVd0yuB8yNPVobap2MIAO+Drr9rEbJ3Wut0/qI7JMsPjeuOehp52mECqEY1EIFUKFUCFUCEX2HfJV3TK4HzI09WhtaqyD1UzysVm3j904qbNCKCsYFt8b9zz0tNMUQoVwLAqhQqgQKoQKoci+Q76qWzrW12naSUeutu6gbaq34/PoQ7t97OeasQeZtH2aA4rMERbfG/c89LTTFEKFcCwKoUKoECqECqHIvkO+qlt+3M0CjIRqoNM6dmO9vW4afW63D61g2IjWzvbO0USWmr7kJCzNs0RuODWTYsYSOUFpDgd4ToacmYnzYjFMkt6C2oyX0QfrpmJF1jxRwz9GcF7sy6u6PMJ5Pi2yfy53CY3BkffLvCCTh7rvvghvGa4Kl9F/JvNQTz8d4aHAczN9MM+vzJSfZt5UZ926Uudb34oQlMiQK9TikA1YHOpp7IvAD3EZMAS4Fup4eAsuEifCvlDNc86JYDagT5AN5DOfiUBx+26JIaAVy13CPZB+Z4wIyocRwUs/97kIfAn7ojOeHOyLVswVLhJzhWnvWxw643ZjXzxmfeHHkfEQ5l8Ki1MRmS98La5yVDhZhfSL70QhTPXqohAqhArhKAphp7NCWEchFNkn4WtxFVL/hz6FUFYh/eI7UQhTvboohAqhQjiKQtjprBDWUQhF9kn4Wlyd+P/CU1Yz/eI7UQhTvboohAqhQjiKQtjprBDWUQhF9kn4WhSRedMvvhOFMNWri0KoECqEoyiEnc4KYR2FUGSfhK9FEZk7l9ThqpvkrAgMoWzJPFMHlUxzovMiR5RIXmSjfHEiyiRUBBKLoj+zgD1Cn8rjmUcjHFECUcmLRMVIoG2Zhx+OEOoi2JRJMF3lvsiRsZorwV0on6vzkpeUOiQH2Cw5e10mSYndsiVSjo1w2tdhzdWRB+4KHjPQn2fU06ec0stpp0Xe9a4IWk89NYLO73lPBFU+1j7FIo3wQ5wI64jilxUsHYlWzAauaiYRRXBVGOAVV0SgIpA6HBlDOO+8CDz8oosiZ58dgXniMrD4Jzzt0ksj7U8AdXAX+uaJ82K8mDpcFdaJRc49N4KLhPIhcDyYNn7gwLS/7311WJyKyHzha1FE5k64VuNpYJcKKoTbUQgVwl3BYwb68wy7aCVQIVQIFcI2CqHIWoGvRRGZO+FajaeBXSqoEG5HIVQIdwWPGejPM+yilUCFUCFUCNsohCJrBb4WRWTuhGs1ngZ2qaBCuB2FUCHcFTxmoD/PsItWAhVChVAhbKMQiqwV+FoUkbkTrtV4GtilggrhdhRChXBX8JiB/jzDLloJVAgVQoWwjUIoslbga1FE5g1F5abIUSWSRf8CvoQi+LAMz9vdF7woUzZEIIRk8NXtabwUpORQCYLhf39m1/8KzTsyp2f63Brh+pZJzhXq9j6vfGWk8bTTIgeVCLT8N0qkfCRzdmR9qUP1Sm1jXpHJa+YzSWvt0r2/vIz9M0fgeT4uks8kRfQDH4ig2kaJDBXBmpwQpL6YoYBGZyz+edZZEZT1mzdHcJG4KqgIXAuXAbnCkWEI0CecF1aDy4DGQMwgwOjcb8UdxDKbN98cwTqxcDxc89//feTWWyNwaUwsFh3FTH7+8xFMO/LFL0bQ2nfpiy+OfOMbEcwG/lIwhNtvj+BhwE8J2criVETmC1+4yY+3/rgT9haRPYGFrEJYoxBWUQgVQoVwrPL1WxVChVBEuvCFm3Ssr9M00JRnYzaOyP12MnY7Nra7j93SfqgZu3HYjqZ2y8DQX2QWWMgqhDUKYRWFUCFUCMcqX79VIVQIRaQLX7jJyPrG/rfBKYVw+q8tu4q6Jdgy6UPN2I2l2d7/KjI7LGQVwhqFsIpCqBAqhGOVr9+qECqEItKFL9xkhQvh8Lnd2G4Z+6Fm7MYyefuIfqvIFLCQVQhrFMIqCqFCqBCOVb5+q0KoEIpIF75wk2UXwuH/tl/bpvpzu2Xsh5qxG8vk7SP6rSILs25dZCF+kdmQ6XNH5OgSATPV8QsQ56UwgDzvCSdEnvvcyBKCerKUf8w8nLkq81jm+5l7M91FOMsXMjjR/ZmfRA7I9T/LDzK4qm9lckXW8okIF7PFiObGGZkf1cEqm6WcW+f++0udH/wgwqIfq6wee2zkpS+N9Du/+MWR3/7tyGteE+kfCuf9vd+LHHNM5BWviPz+70f+7M8ir3pV5LjjIn/wBzOkfygM4aijIhAVCBJ0AqqJ5S5xKHg4RAW6iENBvCGTfdXsGxGGgNZPfjICmcS+M/G850V+/dcjv/ZrEfx7/Q//EMHf1fe+F+m33ndfHRanImuIz6wG+A9FsnghrGlbsQWMOgzd8LVtmrRx7IeasRuH7WgaNg5N2CIyGwphoBAqhBNRCBXCCTalEE6PQrhMbN1WMe6KX9fe1w50rxUJ/6FIFi+EYz9P2gKGDrWJtR8620ef26axpx67sWXSeUX2EIUwUAgVwokohArhBJtSCKdHIVwm+jrh19X+tQPda0XCfyiSJRTCBb+21P7WutxoYw06DJ/bprrPwNiNLeg25V4iE1EIA4VQIZyIQqgQTrAphXB6FMJloq8Tfl3tXzvQvVYk/Ici6Vhfp2mg704LqtTYDpOkrrO9beofGbQH7HwVmRmFMFAIFcKJKIQK4QSbUginRyFcJvo64dfV/rUD3WtFwn8okva/DeK/E/ZpZane0raCsR1GG6dv2q6Du7a0H2pGPWvGNlV77GzCFpFZgQOcVeeWW0odlB9YHPLxxyOPPho5+uhIeVnknnsipXw0QiWAmTxVB6XpJZdEGqcN9UIJUQ7OcOHQk+rsv3+p87WvRaQLdLHHHXdEGn6YuSVzV2Zl8P3vR1C53ntvBJ37+/6//xdBK/bNErl897uR/olwkd/+dgT74qr6R0Zwkf1W/D0fcUQEv/f86Z9G8Pf8L/9l5JBDIgcfHIHk/JN/EvkX/yKCEwEI0q/+auSf/bPI8cdHwL/6VxHw3vdGDjgg8vKXR/7yLyMXXhjBk9PexDq/+ZuRZYLFqYjMF/5NisjcUQgVwmVHIZxsRAphHYVQIdwLsDgVkfnCv0kRmTsKoUK47CiEk41IIayjECqEewEWpyIyX/g3uUzU/28yR7CHyNpFIVQIlx2FcLIRKYR1FEKFcC/A4lRE5gv/JkVk7iiECuGyoxBONiKFsI5CqBDuBVicish84d+kiMh8wfqWMBMshvmTyPoSKU9E2NrfN8/L1gcjbMUapBl2zstg7l2mBTyXkBncshn+xkwfnCjvEQ71ghJZC/O8CKBPF1wQwe9Ml10WwYqd+L3n4osjH/xgL9CYyy+P4FAXXRRBK9aJxUqhaL366sjnPhc5+eTICmH9+sjrXx8588zI+94XOeusyAc+EDnvvAgmFkfGLcO+uIPnnhvBXcgnh8WpiMwX/psjIjJfFMI6a0BUcAf7YPgK4VxQCBVChVBEKvhvjojIfFEI66wBUcEd7IPhK4RzQSFUCBVCEangvzkiIvNFIayzBkQFd7APhq8QzgWFUCFUCEWkgv/miIjMF4WwzhoQFdzBPhi+QjgXFEKFUCEUkQr+myMicweFbKy6SbsgP8tAn7AvCug/z4B7MrjIbvHNKh+XAQPEvrhItF6Q+VEGYHIwIoDzIq/NYPgYL857f+a+DK7q1kyu9coTPZ7BkfutmNj+DQXoDB7L4O7/IAPwbPQfb4wI58WhwPcjkA3U0yhzUQSfc07kmmsi0CeU5ii+zz8/Ak+78srItddGMARcJEwMjgdDQCuCQ2GuMCL4AzpfcUUEbgl/2LQp0uplnbPPjuDIuKG4RzgvjoxrxqFwkbhl2BeTg31xQzGEfjAEXMb73x/BEJD+g4QT4ZnEALHv5s11WJyKyHzhSzLZ2o2ILAkorxXCOmhVCOs83lW+fismtn9DATqDxxRChVAhVAg5QOyrEIqsJPiSTLZyw246TQP8H5tf6H9ufsEOHWY6UZniXAt2EFkqUF4rhHXQqhDWebyrfP1WTGz/hgJ0Bo8phAqhQqgQcoDYVyEUWUnwJZls3fV/kaGpz6xONWv/Guy7mEONWPwRRKYE5bVCWAetCmGdx7vK12/FxPZvKEBn8JhCqBAqhAohB4h9FUKRlQRfksnWXf8XGZr6THKq0Xb817zha72l7VY3dbbUX4cjYGP9AR2Gr8MWkb0HymuFsA5aFcI6j3eVr9+Kie3fUIDO4DGFUCFUCBVCDhD7KoQiKwm+JJOtu/4vMjT1mWRTEK1aw4aNo6+dpvpru6XecdLndiO2DxtF9ipZm7IW35QBqHpRfONQqJiReyNclfHpzE+6CoRWnAhlPewCrQAjQh7J3NcVJFzklzM4MuYZ1/xEBuPFifpHBpiNpzLB3XdH3vKWCNkvU+6KHFUiC+wbd//nPy91yCGR++6LfOITEZLnPfHECFZhJLnvHXdEWKqiNEeJjM4I6ngsaInOWM8ThTuqbegEWqEEM+kEBgjFRWdoal+QsuinW6IzfBhDQDBXuCpoDE4EaYfEovMww6PgMl760sgJJ0T+6q8i731vBB6OIWCJTlzke94TQef+kSGEuN2wONwUPAw4ES4SrXjacyZZnIpMx8WyRPClmWzd9X+RoanPyLVqhu3o1t+Or9g+bKypt1e9xhxkwQ4iexuFUCFUCBVChVAhVAhFZoNaI3sKX5rJ1l3/Fxma+kxyqikdbNLXsYcdu7E029uDLNhBZG+jECqECqFCqBAqhAqhyGxQa2RP4Usz2brr/yJDU59JTjWlg7W7j7a02ydtLM329lwLdhDZ2yiECqFCqBAqhAqhQigyG9Qa2VP40ky2csNuOk0Dk5xqSgdrd9+6A2wc0dleH78916STTjqgyJKjECqECqFCqBAqhAqhyGxQa2RP4Usz2drNgowErGbYjm7Dh063zsYyeXvJy6g34kO7HbuI7BUWKIKzgEbRf9JJEbJ/5mWZcmOmu2/5RGZLJslrBk89FSF5XhT9pTyb6e37k59E1q2LkLzm738/Up6XAQdkyk117r231CG57wteEGkUNzk0s74bkOf99KcjKIlJ7gsDfOELIwTXXP4ic10mOTBTfljn1FNLHZL7vvnNERbB0AkU32hFxYyqFyUydAKVOtbGRJWPfRFU6th3prVA+0t0ojMcDyPCeTFXaL001QuBXeBQOG9fkDAEDLB/B2FTeBjQiicHa8yic1+fMBsYL6QOzwYuEvviMnCo/i1Da/9RwYhyvCxORWS+8KW54tHQZK2hEAZ5XoVQIdyNQtgJanGFUCEcgovEvrgMhVBkn4QvzZWNNihrEIUwyPMqhArhbhTCTlCLK4QK4RBcJPbFZSiEIvskfGmuVPx/vSlrFoUwyPMqhArhbhTCTlCLK4QK4RBcJPbFZSiEIvskfGmKyJxRCIM8r0KoEO5GIewEtbhCqBAOwUViX1yGQiiyT8KXpojMm6O6KzqygD6nzsMPlzoki+D774889FCEPDdzZOSIIyIkr3k2icV5aZ6/zPT2PfDASHlJBnSvub+8J877sY9FmqVfe/v+4AeRUs7KJBTvWPsUK2USKu7n6px2WqlDuO8P6nABT8BrhvFuyCR53o98JNIs39rb94knIixk+1U+ylx07lscauJ+pQ6dwJFRuEPMMCJcRt+m+o4HQcLKmWjtDx8nQivO22/FTYFczXSP0Iq5wpHRiuH3BQn7YibRikNB2jGTGAKuCs8VRoR/OHAZ/ZvSv/vd283iVETmC1+aIjJvFMIanFchVAgH8rwKoUK4OwphHQwBV6UQikgDX5oiMm8UwhqcVyFUCAfyvAqhQrg7CmEdDAFXpRCKSANfmiIybxTCGpxXIVQIB/K8CqFCuDsKYR0MAVelEIpIA1+aIjJvFMIanFchVAgH8rwKoUK4OwphHQwBV6UQikgDX5oiMne6skEhfDxzUyY5KJNLdI7+t1wG+vsec0ykrO+uYMmi/xd1tmwpdUieF6t9bt4cIc/PlOPqoEYimOffiiywgmWed/36SClnZ3r73nRTZAHymr/5zcgzz0TIwZG77oqUckGmty9WGS3l/kySz8Zs1/yCzGGRm2+OEOx7dAalar+sRy7tLoaJAvqDH4ygYkbxjUcWxTcuA4eCMMCIEFwVToTLwFz1/QEXic44FGYSnXGo/9/O2atEEkRhtOONFh9AZKN9DoMJxEANDAbDCQTx9ylEFFQMTHyoDRcm3YfYaHei5n5Hpphmm4Fmz+FLiu7pulVNT9fpoNqzgX1y0RFuCvptd4TgUtiEE/OMe4SJheHjKG7o7W0E3ywWi8jFReTuLoJLXV9HcDK+511dRc7PI7gyvjNlR1ycish24UtTRLaOQlhQCBXCdTUrhDUoQyGsUQgVQhEZAl+aIrJ1FMKCQqgQrqtZIaxBGQphjUKoEIrIEPjSFJGtoxAWFEKFcF3NCmENylAIaxRChVBEhsCXpohsHYWwoBAqhOtqVghrUIZCWKMQKoQiMgS+NEVk23zLgFxA7+1Fhi2gu3nN7m5XQ/jbptWAr9iF8ncNFlSfiK0yu+5X5mfN4WFXg3739yMvL5Gzswg4OoqgZvSLNdLBQQQbaZ6edjU7O5HZLLIqpAZVwR4xXuzYeXLS1eDK83lX03U/ajBXGC9mAwtIjAhHP3GTCdDvmGDfxcvLCI4iWOZiiYytIzF+fGnAyXBL2EUbDAE5Po4AfHd5f488PUVubiL4LaSubdp4zHApqNfjYwSu9fwcwdShKkgsTn57i+BkVIWjDw8RjAgiiqru7yOYq3Ywkyjy9TWCf8aPjwj+ZXB0PLg4nSCLf2A2hO8ia+BzJSJTQiEMFEKFsE+AfsdEIazAWxRChVAh3ABK3hBWmrf8s+zTbq7W/Ysvyz42/7dmAz5XIjIlFMJAIVQI+wTod0wUwgq8RSFUCBXCDaDkDaFtgAqhzdpswOdKRKaEQhgohAphnwD9jolCWIG3KIQKoUK4AZS8IbQNUCG0WZsN+FyJyJRQCAOFUCHsE6DfMVEIK/AWhVAhVAg3gJI3hLYBKoQ2a7MBnysRmQ5/AYhTOmD45w+0AAAAAElFTkSuQmCC80:T76c,I2xjY19EREBXQ0pPWVxWT2pHZFpGNyIkPUNGdldfN1pNVVUmayJWOVYza31YOlxnPXtuNnNiW042SmpwJyh+SndTaitnUWQldm5NLE4/bilpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiZ2cFk8fUclXy5KWjZ3RXdZY2swXFlzVlQyQypV81:T760,JUhuYkZyLi9jPiBCKSQ4JE4lKmV+SzhcTnt1K2M2dSNBOGR3K3RKcU0hfW4+QSxnM1V6ZXgodW0rc2B8dHhBYil1aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS44LSc5MzpfR2VZdTRgMSJHIkQsRnQyN1VPMyl4aUB5KyJQ82:T768,KD9uKic5X2QyUm5aUjsvaiItdHEkR3FJaz0rSyAtKixkXEg1aXpoUnpKXTNCQDk6dlFMUUxGNV18aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ja2pNWyRkY3tTMHledm00O35HSCZ4SzV6UENkZ2FdfG1dUzJycytIOUA2MStiKEY=83:T784,KSxgTGIyWCBAXmcybHl5KVcubiBILkgnJEs7KERlSCRLY1lQa098KlxnXWVOKiwiNy1IS0VKLUcqTFUzS0MhIH4gSkZkQXRtWTZwMjozYD58RjVYUWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuN1p4JG1ZXmhWY0MhcjFdQE0rXnlDPnNEL2sjfFx2Tio8KSZTOTQ/VQ==84:T740,MWIgKCAzP0I7SDZhRiliX0VSRjEtbHMhS3JzPk5UOFYoZ1xVSTU0VHl3Zkk5RkozKEFWQWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubHNAcV9SK3wrc0MiYztQQlUnPCAyYjpT85:T748,MkZfa1V3RG5WdVA+Tkg8K3M1cFAtXEktbXFXez5temFHXk9SMCZJa0U/bHVIU1RBU2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuLGVgfilpQDN+cj8sdi4oOTFLUylzbHNNRyRPTnk8Jg==86:T758,NFlJKyRScl1ARjY2LV5lNDNrKyAlX319d2xcZTVQJnNyclZKYTU/NFBFQlkvU2ZfVHlIZSU4K2VVZVhfJXs7Z2ZhRnVgO2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubDpPV0JdXzxyTmhRdWRJKycyNC1SdGAt87:T764,OCUiMV9EYXhldCNuKiMpJG5PSH1+eTR3ZktsandpWy5ELDhnXDR1MCxfbGdURiBAdm1UWmg0dXQlYDM7dGZ0MzhTJE1tSlguXGAibXMuYCBZSitpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlRGRi1cVm5qOHFeRDcwLDRgcw==88:T76c,OyJoa1dkYWkiZSVzZHNkMztLQmV+M20zOmRZKFp5UWVcdH49MTdcZyNCKHg/WHVDXXwvZV8ndmdWTTR2ezR3KkFmZlVXeSxAZkhcLEEmUzV7ekJzMy90NyE0I2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRCZnQTI4IitYTzJtOC5CN0lO89:T76c,O3UkZTE6biIqIStORmhmPVN1QjVtYVBjfkpMJ2dqW3s5STtDU2wmfUM3eikvQWt+RmlsQy9rZ3kofVkyIDEoQ1Z5OywtPnpEPT4tPHlhXz9zPklJSj4xfTdoaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ZcWFaSklcdld2KVd8L3VIOSQ=8a:T750,PC9zdkA5JH5KSkNCMmZOOjU7Y1FTJ0s3WnclVzVCQXZeZkB4cSl2cipcVG9JPUVlW0xVXndkRm1DSSI4aGdzeG9QfFR7d097TmtpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS4hXSVsK1ZtUXMrMC468b:T764,PTUiYy0oV0ctNUQ0QUg8YF9rbisgVSMzJHB5Sm5hRGInNDxKPyFwSmZfI09nXiJCJDB3T1N0JXRraWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5Iek4iUWt4bzRjTE46M19mUlFMVENrb3JxN0xULHVZfjdiMENxbVBMZVlrXmk=8c:T748,XGN0S2xiZiE7X31Ze104flBxVmZxQSU9JHMycn5ATX57NTZiJV58P3psczU2d3Q1JyRHPlk/PEN8Qyssd2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRV1SYj9ycT0xfmRlSE1KMydHKA==8d:T750,XFR7e0c/P3JEOSYwTiAgWEd3WmBme2c3ZkdhV0RVViVJOF9+ZSwpeFBlSmc7QG4kMiUlNlFGfH5GLixPfkNrODs/WS5pbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiRMSC19TTldVlR2SVomMlRbWk568e:T73c,QUMlXlQmREkjMDt1b0RpXmRyJGBQXkZ1OXRWW15jLFxoMl83eltFdkpXeSkoMExLISM0ay5eIll4MmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuMmpdMyxfajJYQXRZeg==8f:T778,YjopW0cjL2ovbHFIID81OGVZY29VXnI7VFE4ajNFIy1aWVgzMSxXdUxmRi9dKD8+Ojd0SFVnV0tUN080P21cdyhzY11lJDJuISV0X18iUD98RmlXIilUSV1pPlcpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS52MGZERWVuN2hFS2h6a1F4diVKfnMzRVM890:T774,Yz09ei14RHciQj47WThSQ0V6MUsgLiJ9aU94ZVcnM0cwVVd0Ql9qRTAwfXQ2OiwtaSFAIlxyM0tXNGxhIVInT2VKY0dVJHV7KGBPcU5dO2RpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkNHSWI5Oj1ZWDdHc0F9J1tKY2InND5SdF5uPTNIZnZuRQ==91:T784,Qz1MKmxcNEJKS11+STApUktdaEZZY1MmKTAyVnY0TXIudUJHfGtxaFo2MXE7OT5TVU4hbTQiNVRjS2hpImx0UzZicSk8LC0jQ15CX3JAMFR5aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5rVypuOE5GXmBIai1Sdm1bRnRkSWUnLztQdSQ7eHQpMVxjLHEhLj4+OzVJR2xd92:T748,ZSk9XSlNUFlgRXxTR21hQ21dZEZfbVQ7Z3x4QkY4e2BONitvU2s4Ll9ZcGpDfnhaOGdpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLnBzYVUzVDllWml0NWUoZDlEXWtSWUZTUVlDXFoueWdm93:T748,RU5AdCtnRFJYKT82QiM9NV97RHpmJVosel0nQyNKRkI3Um1lZm1nQHgxaHxvMH08Y2JpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkhtKkR2MDE/UUYuOHF3aHBYfSQsaVZncyl5ckN3Yg==94:T544,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlQ=95:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uu96:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uu97:T77c,bTlEM20qOHEnRk15fCA9KklWeHA2O24/W2FDOXNIKy4+anE8NXElfGZYPSohcDlUOlJWNGtqbS9AZnAscFVCdHJ3WV1VQlVzKUQgNEVfc3xQfV0oZmwuKUZmLyhpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlBaZjFyKzJ8KzpJImkrPSlqK0lVSjZiRHFwJA==98:T77c,TTpqKHpRIip8cnJNVjNaR0NobzJaVjRiZU1DJSQ9OmghaVUwTnBlQExDOFU9MlZPRDV8bldbNURvY004ZEszQD45bltEN2YjbWNxc2lZWm5bcVRnaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5pPzBJNHdQXjR6IW1bd1RTOS1AJGU3fkUhRWUuTCVrOVJvLyM=99:T75c,bzhFRk1LMT5cWyVEdWJwKiA9WFJZaSpETmlYVl0pbkp4JFNsP35hQW42TXxIc088cydTeEg2dWl9TGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuKXBoPjx2S1hqSjMzcW9dVCgwa3NdR09DdHZHNip4cyw2Z1E1eyN39a:T75c,UDQ6W0JYe2RjXEZiOW97PV1vfiZvOTdLdVE9MHs+Kk5lZXduRSslfmFJWXZBS3std1d2TGYhX0t5UmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuNzNxfl5NIFc8SHZZazYjLWVBdGk6WV1fS1lbRDg1XTFubVllVj1f9b:T550,UyBhbmQgYmUgYmFjayBvbiB0cmFjayB3aXRoaW4gMjQgaG91cnMgYXBwcm94aW1hdGVseS4gT3VyIGRlY3J5cHRvciB3b3JrcyBwcm9wZXJseSBvbiBhbnkgZmlsZXMgb3Igc3lzdGVtcywgc28geW91IHdpbGwgYmUgYWJsZSB0byBjaGVjayBpdCBieSByZXF1ZXN0aW5nIGEgdGVzdCBkZWNyeXB0aW9uIHNlcnZpY2UgZnJvbSB0aGUgYmVnaW5uaW5nIG9mIG91ciBjb252ZXJzYXRpb24uIElmIHlvdSBkZWNpZGUgdG8gcmVjb3ZlciBvbiB5b3VyIG93biwga2VlcCBpbiBtaW5kIHRoYXQgeW91IGNhbiBwZXJtYW5lbnRseSBsb3NlIGFjY2VzcyB0byBzb21lIGZpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN19c:T750,c1xSUC52P3h9Wi1pLX5QbSl6a3k+a3JiSWdYPyR2NjJpfVp4MmMkUVdAeXktcFw9a2NAWUJMJixfdld+K2QtVGgtMGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UufDMyQEc1OlQySmtEQEs/YUJ5R3479d:T764,U2BxTWwxYWp+OGZqRmJ1Jn5QTmR+N3hya3ApZyFsW11gPH06XHk8ZjVdSXddRS5BVWkkIylrQ1NrYm47TUlYSW9NPDZRVil9O3J8JklaRnZvLCFpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLmwobUJCZ2NsOz5jMH5SWT0tdT449e:T774,VSQnRWlza2hneWVYeCFnTm5IXVd1OHhCOmBpWDJpOEI2YjgiTjI0IEdYMzMlbTIxNSFkL0M4LUBwaUFLbHxAMVtDSE9ZWiwgZGJTOzc3L1ZMPko5WGgkXlkpV1JSaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5zQk1LUVxNckksbiFaXXomdzhPdw==9f:T760,dWJFUlpBSW90ZCpXTVlNKDR5cV06SzZ+M2ApeXtRbkolPj1zfXBvWCNsQC94Xj01J0toP2whJ3ogWmZfXStCTEJFaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS56dy0/byM+QXpmOmc6PTV7QHRHanB9V0R1Sld+ckBSLl0pa0:T744,diQiWTE+cEJCXEJZPm9HUzt+Xz9iSHV+U3wiSG9AYlVMVil3fDliITA7RktycTRWQ1wgNXRBPmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuOVJNImlPK0ZGKEY7MylUOllZI0JYKU0=a1:T78c,WFYwMG85I0gzJ1wsTkpdIGU4PyRPMD5XT0J9RjZ8Z2MnM1Jtd35hXVx7RWkocDx6JGdESzlSJChmL2NAKE5APSk5c3J5UFdqIS1CdH41eSJIcFdSNylxSyBHJC0sXWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuJnYuLm5lSGpJMiJJUCVMc0dgZmgqT35TSDdIaTh9NW93eF9EaA==a2:T76c,I2xjY19EREBXQ0pPWVxWT2pHZFpGNyIkPUNGdldfN1pNVVUmayJWOVYza31YOlxnPXtuNnNiW042SmpwJyh+SndTaitnUWQldm5NLE4/bilpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiZ2cFk8fUclXy5KWjZ3RXdZY2swXFlzVlQyQypVa3:T760,JUhuYkZyLi9jPiBCKSQ4JE4lKmV+SzhcTnt1K2M2dSNBOGR3K3RKcU0hfW4+QSxnM1V6ZXgodW0rc2B8dHhBYil1aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS44LSc5MzpfR2VZdTRgMSJHIkQsRnQyN1VPMyl4aUB5KyJQa4:T768,KD9uKic5X2QyUm5aUjsvaiItdHEkR3FJaz0rSyAtKixkXEg1aXpoUnpKXTNCQDk6dlFMUUxGNV18aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ja2pNWyRkY3tTMHledm00O35HSCZ4SzV6UENkZ2FdfG1dUzJycytIOUA2MStiKEY=a5:T784,KSxgTGIyWCBAXmcybHl5KVcubiBILkgnJEs7KERlSCRLY1lQa098KlxnXWVOKiwiNy1IS0VKLUcqTFUzS0MhIH4gSkZkQXRtWTZwMjozYD58RjVYUWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuN1p4JG1ZXmhWY0MhcjFdQE0rXnlDPnNEL2sjfFx2Tio8KSZTOTQ/VQ==a6:T740,MWIgKCAzP0I7SDZhRiliX0VSRjEtbHMhS3JzPk5UOFYoZ1xVSTU0VHl3Zkk5RkozKEFWQWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubHNAcV9SK3wrc0MiYztQQlUnPCAyYjpTa7:T748,MkZfa1V3RG5WdVA+Tkg8K3M1cFAtXEktbXFXez5temFHXk9SMCZJa0U/bHVIU1RBU2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuLGVgfilpQDN+cj8sdi4oOTFLUylzbHNNRyRPTnk8Jg==a8:T758,NFlJKyRScl1ARjY2LV5lNDNrKyAlX319d2xcZTVQJnNyclZKYTU/NFBFQlkvU2ZfVHlIZSU4K2VVZVhfJXs7Z2ZhRnVgO2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubDpPV0JdXzxyTmhRdWRJKycyNC1SdGAta9:T764,OCUiMV9EYXhldCNuKiMpJG5PSH1+eTR3ZktsandpWy5ELDhnXDR1MCxfbGdURiBAdm1UWmg0dXQlYDM7dGZ0MzhTJE1tSlguXGAibXMuYCBZSitpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlRGRi1cVm5qOHFeRDcwLDRgcw==aa:T76c,OyJoa1dkYWkiZSVzZHNkMztLQmV+M20zOmRZKFp5UWVcdH49MTdcZyNCKHg/WHVDXXwvZV8ndmdWTTR2ezR3KkFmZlVXeSxAZkhcLEEmUzV7ekJzMy90NyE0I2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRCZnQTI4IitYTzJtOC5CN0lOab:T76c,O3UkZTE6biIqIStORmhmPVN1QjVtYVBjfkpMJ2dqW3s5STtDU2wmfUM3eikvQWt+RmlsQy9rZ3kofVkyIDEoQ1Z5OywtPnpEPT4tPHlhXz9zPklJSj4xfTdoaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ZcWFaSklcdld2KVd8L3VIOSQ=ac:T750,PC9zdkA5JH5KSkNCMmZOOjU7Y1FTJ0s3WnclVzVCQXZeZkB4cSl2cipcVG9JPUVlW0xVXndkRm1DSSI4aGdzeG9QfFR7d097TmtpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS4hXSVsK1ZtUXMrMC46ad:T764,PTUiYy0oV0ctNUQ0QUg8YF9rbisgVSMzJHB5Sm5hRGInNDxKPyFwSmZfI09nXiJCJDB3T1N0JXRraWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5Iek4iUWt4bzRjTE46M19mUlFMVENrb3JxN0xULHVZfjdiMENxbVBMZVlrXmk=ae:T748,XGN0S2xiZiE7X31Ze104flBxVmZxQSU9JHMycn5ATX57NTZiJV58P3psczU2d3Q1JyRHPlk/PEN8Qyssd2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRV1SYj9ycT0xfmRlSE1KMydHKA==af:T750,XFR7e0c/P3JEOSYwTiAgWEd3WmBme2c3ZkdhV0RVViVJOF9+ZSwpeFBlSmc7QG4kMiUlNlFGfH5GLixPfkNrODs/WS5pbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiRMSC19TTldVlR2SVomMlRbWk56b0:T73c,QUMlXlQmREkjMDt1b0RpXmRyJGBQXkZ1OXRWW15jLFxoMl83eltFdkpXeSkoMExLISM0ay5eIll4MmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuMmpdMyxfajJYQXRZeg==b1:T778,YjopW0cjL2ovbHFIID81OGVZY29VXnI7VFE4ajNFIy1aWVgzMSxXdUxmRi9dKD8+Ojd0SFVnV0tUN080P21cdyhzY11lJDJuISV0X18iUD98RmlXIilUSV1pPlcpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS52MGZERWVuN2hFS2h6a1F4diVKfnMzRVM8b2:T774,Yz09ei14RHciQj47WThSQ0V6MUsgLiJ9aU94ZVcnM0cwVVd0Ql9qRTAwfXQ2OiwtaSFAIlxyM0tXNGxhIVInT2VKY0dVJHV7KGBPcU5dO2RpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkNHSWI5Oj1ZWDdHc0F9J1tKY2InND5SdF5uPTNIZnZuRQ==b3:T784,Qz1MKmxcNEJKS11+STApUktdaEZZY1MmKTAyVnY0TXIudUJHfGtxaFo2MXE7OT5TVU4hbTQiNVRjS2hpImx0UzZicSk8LC0jQ15CX3JAMFR5aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5rVypuOE5GXmBIai1Sdm1bRnRkSWUnLztQdSQ7eHQpMVxjLHEhLj4+OzVJR2xdb4:T748,ZSk9XSlNUFlgRXxTR21hQ21dZEZfbVQ7Z3x4QkY4e2BONitvU2s4Ll9ZcGpDfnhaOGdpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLnBzYVUzVDllWml0NWUoZDlEXWtSWUZTUVlDXFoueWdmb5:T748,RU5AdCtnRFJYKT82QiM9NV97RHpmJVosel0nQyNKRkI3Um1lZm1nQHgxaHxvMH08Y2JpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkhtKkR2MDE/UUYuOHF3aHBYfSQsaVZncyl5ckN3Yg==b6:T544,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlQ=b7:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uub8:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uub9:T77c,bTlEM20qOHEnRk15fCA9KklWeHA2O24/W2FDOXNIKy4+anE8NXElfGZYPSohcDlUOlJWNGtqbS9AZnAscFVCdHJ3WV1VQlVzKUQgNEVfc3xQfV0oZmwuKUZmLyhpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlBaZjFyKzJ8KzpJImkrPSlqK0lVSjZiRHFwJA==ba:T77c,TTpqKHpRIip8cnJNVjNaR0NobzJaVjRiZU1DJSQ9OmghaVUwTnBlQExDOFU9MlZPRDV8bldbNURvY004ZEszQD45bltEN2YjbWNxc2lZWm5bcVRnaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5pPzBJNHdQXjR6IW1bd1RTOS1AJGU3fkUhRWUuTCVrOVJvLyM=bb:T75c,bzhFRk1LMT5cWyVEdWJwKiA9WFJZaSpETmlYVl0pbkp4JFNsP35hQW42TXxIc088cydTeEg2dWl9TGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuKXBoPjx2S1hqSjMzcW9dVCgwa3NdR09DdHZHNip4cyw2Z1E1eyN3bc:T75c,UDQ6W0JYe2RjXEZiOW97PV1vfiZvOTdLdVE9MHs+Kk5lZXduRSslfmFJWXZBS3std1d2TGYhX0t5UmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuNzNxfl5NIFc8SHZZazYjLWVBdGk6WV1fS1lbRDg1XTFubVllVj1fbd:T550,UyBhbmQgYmUgYmFjayBvbiB0cmFjayB3aXRoaW4gMjQgaG91cnMgYXBwcm94aW1hdGVseS4gT3VyIGRlY3J5cHRvciB3b3JrcyBwcm9wZXJseSBvbiBhbnkgZmlsZXMgb3Igc3lzdGVtcywgc28geW91IHdpbGwgYmUgYWJsZSB0byBjaGVjayBpdCBieSByZXF1ZXN0aW5nIGEgdGVzdCBkZWNyeXB0aW9uIHNlcnZpY2UgZnJvbSB0aGUgYmVnaW5uaW5nIG9mIG91ciBjb252ZXJzYXRpb24uIElmIHlvdSBkZWNpZGUgdG8gcmVjb3ZlciBvbiB5b3VyIG93biwga2VlcCBpbiBtaW5kIHRoYXQgeW91IGNhbiBwZXJtYW5lbnRseSBsb3NlIGFjY2VzcyB0byBzb21lIGZpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1be:T750,c1xSUC52P3h9Wi1pLX5QbSl6a3k+a3JiSWdYPyR2NjJpfVp4MmMkUVdAeXktcFw9a2NAWUJMJixfdld+K2QtVGgtMGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UufDMyQEc1OlQySmtEQEs/YUJ5R347bf:T764,U2BxTWwxYWp+OGZqRmJ1Jn5QTmR+N3hya3ApZyFsW11gPH06XHk8ZjVdSXddRS5BVWkkIylrQ1NrYm47TUlYSW9NPDZRVil9O3J8JklaRnZvLCFpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLmwobUJCZ2NsOz5jMH5SWT0tdT44c0:T774,VSQnRWlza2hneWVYeCFnTm5IXVd1OHhCOmBpWDJpOEI2YjgiTjI0IEdYMzMlbTIxNSFkL0M4LUBwaUFLbHxAMVtDSE9ZWiwgZGJTOzc3L1ZMPko5WGgkXlkpV1JSaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5zQk1LUVxNckksbiFaXXomdzhPdw==c1:T760,dWJFUlpBSW90ZCpXTVlNKDR5cV06SzZ+M2ApeXtRbkolPj1zfXBvWCNsQC94Xj01J0toP2whJ3ogWmZfXStCTEJFaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS56dy0/byM+QXpmOmc6PTV7QHRHanB9V0R1Sld+ckBSLl0pc2:T744,diQiWTE+cEJCXEJZPm9HUzt+Xz9iSHV+U3wiSG9AYlVMVil3fDliITA7RktycTRWQ1wgNXRBPmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuOVJNImlPK0ZGKEY7MylUOllZI0JYKU0=c3:T78c,WFYwMG85I0gzJ1wsTkpdIGU4PyRPMD5XT0J9RjZ8Z2MnM1Jtd35hXVx7RWkocDx6JGdESzlSJChmL2NAKE5APSk5c3J5UFdqIS1CdH41eSJIcFdSNylxSyBHJC0sXWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuJnYuLm5lSGpJMiJJUCVMc0dgZmgqT35TSDdIaTh9NW93eF9EaA==c4:T544,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlQ=c5:T550,UyBhbmQgYmUgYmFjayBvbiB0cmFjayB3aXRoaW4gMjQgaG91cnMgYXBwcm94aW1hdGVseS4gT3VyIGRlY3J5cHRvciB3b3JrcyBwcm9wZXJseSBvbiBhbnkgZmlsZXMgb3Igc3lzdGVtcywgc28geW91IHdpbGwgYmUgYWJsZSB0byBjaGVjayBpdCBieSByZXF1ZXN0aW5nIGEgdGVzdCBkZWNyeXB0aW9uIHNlcnZpY2UgZnJvbSB0aGUgYmVnaW5uaW5nIG9mIG91ciBjb252ZXJzYXRpb24uIElmIHlvdSBkZWNpZGUgdG8gcmVjb3ZlciBvbiB5b3VyIG93biwga2VlcCBpbiBtaW5kIHRoYXQgeW91IGNhbiBwZXJtYW5lbnRseSBsb3NlIGFjY2VzcyB0byBzb21lIGZpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1c6:T76c,I2xjY19EREBXQ0pPWVxWT2pHZFpGNyIkPUNGdldfN1pNVVUmayJWOVYza31YOlxnPXtuNnNiW042SmpwJyh+SndTaitnUWQldm5NLE4/bilpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiZ2cFk8fUclXy5KWjZ3RXdZY2swXFlzVlQyQypVc7:T760,JUhuYkZyLi9jPiBCKSQ4JE4lKmV+SzhcTnt1K2M2dSNBOGR3K3RKcU0hfW4+QSxnM1V6ZXgodW0rc2B8dHhBYil1aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS44LSc5MzpfR2VZdTRgMSJHIkQsRnQyN1VPMyl4aUB5KyJQc8:T768,KD9uKic5X2QyUm5aUjsvaiItdHEkR3FJaz0rSyAtKixkXEg1aXpoUnpKXTNCQDk6dlFMUUxGNV18aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ja2pNWyRkY3tTMHledm00O35HSCZ4SzV6UENkZ2FdfG1dUzJycytIOUA2MStiKEY=c9:T784,KSxgTGIyWCBAXmcybHl5KVcubiBILkgnJEs7KERlSCRLY1lQa098KlxnXWVOKiwiNy1IS0VKLUcqTFUzS0MhIH4gSkZkQXRtWTZwMjozYD58RjVYUWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuN1p4JG1ZXmhWY0MhcjFdQE0rXnlDPnNEL2sjfFx2Tio8KSZTOTQ/VQ==ca:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uucb:Tdc4,SGkgZnJpZW5kcyxXaGF0ZXZlciB3aG8geW91IGFyZSBhbmQgd2hhdCB5b3VyIHRpdGxlIGlzIGlmIHlvdSdyZSByZWFkaW5nIHRoaXMgaXQgbWVhbnMgdGhlIGludGVybmFsIGluZnJhc3RydWN0dXJlIG9mIHlvdXIgY29tcGFueSBpcyBmdWxseSBvciBwYXJ0aWFsbHkgZGVhZCwgYWxsIHlvdXIgYmFja3VwcyAtIHZpcnR1YWwsIHBoeXNpY2FsIC0gZXZlcnl0aGluZyB0aGF0IHdlIG1hbmFnZWQgdG8gcmVhY2ggLSBhcmUgY29tcGxldGVseSByZW1vdmVkLiBNb3Jlb3Zlciwgd2UgaGF2ZSB0YWtlbiBhIGdyZWF0IGFtb3VudCBvZiB5b3VyIGNvcnBvcmF0ZSBkYXRhIHByaW9yIHRvIGVuY3J5cHRpb24uV2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzoxLiBEZWFsaW5nIHdpdGggdXMgeW91IHdpbGwgc2F2ZSBBIExPVCBkdWUgdG8gd2UgYXJlIG5vdCBpbnRlcmVzdGVkIGluIHJ1aW5pbmcgeW91ciBmaW5hbmNpYWxseS4gV2Ugd2lsbCBzdHVkeSBpbiBkZXB0aCB5b3VyIGZpbmFuY2UsIGJhbmsgJiBpbmNvbWUgc3RhdGVtZW50cywgeW91ciBzYXZpbmdzLCBpbnZlc3RtZW50cyBldGMuIGFuZCBwcmVzZW50IG91ciByZWFzb25hYmxlIGRlbWFuZCB0byB5b3UuIElmIHlvdSBoYXZlIGFuIGFjdGl2ZSBjeWJlciBpbnN1cmFuY2UsIGxldCB1cyBrbm93IGFuZCB3ZSB3aWxsIGd1aWRlIHlvdSBob3cgdG8gcHJvcGVybHkgdXNlIGl0LiBBbHNvLCBkcmFnZ2luZyBvdXQgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgd2lsbCBsZWFkIHRvIGZhaWxpbmcgb2YgYSBkZWFsLjIuIFBheWluZyB1cyB5b3Ugc2F2ZSB5b3VyIFRJTUUsIE1PTkVZLCBFRkZPUlRTIGFuZCBiZSBiYWNrIG9uIHRyYWNrIHdpdGhpbiAyNCBob3VycyBhcHByb3hpbWF0ZWx5LiBPdXIgZGVjcnlwdG9yIHdvcmtzIHByb3Blcmx5IG9uIGFueSBmaWxlcyBvciBzeXN0ZW1zLCBzbyB5b3Ugd2lsbCBiZSBhYmxlIHRvIGNoZWNrIGl0IGJ5IHJlcXVlc3RpbmcgYSB0ZXN0IGRlY3J5cHRpb24gc2VydmljZSBmcm9tIHRoZSBiZWdpbm5pbmcgb2Ygb3VyIGNvbnZlcnNhdGlvbi4gSWYgeW91IGRlY2lkZSB0byByZWNvdmVyIG9uIHlvdXIgb3duLCBrZWVwIGluIG1pbmQgdGhhdCB5b3UgY2FuIHBlcm1hbmVudGx5IGxvc2UgYWNjZXNzIHRvIHNvbWUgZmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2Uucc:T740,MWIgKCAzP0I7SDZhRiliX0VSRjEtbHMhS3JzPk5UOFYoZ1xVSTU0VHl3Zkk5RkozKEFWQWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubHNAcV9SK3wrc0MiYztQQlUnPCAyYjpTcd:T748,MkZfa1V3RG5WdVA+Tkg8K3M1cFAtXEktbXFXez5temFHXk9SMCZJa0U/bHVIU1RBU2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuLGVgfilpQDN+cj8sdi4oOTFLUylzbHNNRyRPTnk8Jg==ce:T758,NFlJKyRScl1ARjY2LV5lNDNrKyAlX319d2xcZTVQJnNyclZKYTU/NFBFQlkvU2ZfVHlIZSU4K2VVZVhfJXs7Z2ZhRnVgO2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UubDpPV0JdXzxyTmhRdWRJKycyNC1SdGAtcf:T764,OCUiMV9EYXhldCNuKiMpJG5PSH1+eTR3ZktsandpWy5ELDhnXDR1MCxfbGdURiBAdm1UWmg0dXQlYDM7dGZ0MzhTJE1tSlguXGAibXMuYCBZSitpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlRGRi1cVm5qOHFeRDcwLDRgcw==d0:T76c,OyJoa1dkYWkiZSVzZHNkMztLQmV+M20zOmRZKFp5UWVcdH49MTdcZyNCKHg/WHVDXXwvZV8ndmdWTTR2ezR3KkFmZlVXeSxAZkhcLEEmUzV7ekJzMy90NyE0I2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRCZnQTI4IitYTzJtOC5CN0lOd1:T76c,O3UkZTE6biIqIStORmhmPVN1QjVtYVBjfkpMJ2dqW3s5STtDU2wmfUM3eikvQWt+RmlsQy9rZ3kofVkyIDEoQ1Z5OywtPnpEPT4tPHlhXz9zPklJSj4xfTdoaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5ZcWFaSklcdld2KVd8L3VIOSQ=d2:T750,PC9zdkA5JH5KSkNCMmZOOjU7Y1FTJ0s3WnclVzVCQXZeZkB4cSl2cipcVG9JPUVlW0xVXndkRm1DSSI4aGdzeG9QfFR7d097TmtpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS4hXSVsK1ZtUXMrMC46d3:T764,PTUiYy0oV0ctNUQ0QUg8YF9rbisgVSMzJHB5Sm5hRGInNDxKPyFwSmZfI09nXiJCJDB3T1N0JXRraWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5Iek4iUWt4bzRjTE46M19mUlFMVENrb3JxN0xULHVZfjdiMENxbVBMZVlrXmk=d4:T748,XGN0S2xiZiE7X31Ze104flBxVmZxQSU9JHMycn5ATX57NTZiJV58P3psczU2d3Q1JyRHPlk/PEN8Qyssd2lsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuRV1SYj9ycT0xfmRlSE1KMydHKA==d5:T750,XFR7e0c/P3JEOSYwTiAgWEd3WmBme2c3ZkdhV0RVViVJOF9+ZSwpeFBlSmc7QG4kMiUlNlFGfH5GLixPfkNrODs/WS5pbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLiRMSC19TTldVlR2SVomMlRbWk56d6:T73c,QUMlXlQmREkjMDt1b0RpXmRyJGBQXkZ1OXRWW15jLFxoMl83eltFdkpXeSkoMExLISM0ay5eIll4MmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuMmpdMyxfajJYQXRZeg==d7:T778,YjopW0cjL2ovbHFIID81OGVZY29VXnI7VFE4ajNFIy1aWVgzMSxXdUxmRi9dKD8+Ojd0SFVnV0tUN080P21cdyhzY11lJDJuISV0X18iUD98RmlXIilUSV1pPlcpaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS52MGZERWVuN2hFS2h6a1F4diVKfnMzRVM8d8:T774,Yz09ei14RHciQj47WThSQ0V6MUsgLiJ9aU94ZVcnM0cwVVd0Ql9qRTAwfXQ2OiwtaSFAIlxyM0tXNGxhIVInT2VKY0dVJHV7KGBPcU5dO2RpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkNHSWI5Oj1ZWDdHc0F9J1tKY2InND5SdF5uPTNIZnZuRQ==d9:T784,Qz1MKmxcNEJKS11+STApUktdaEZZY1MmKTAyVnY0TXIudUJHfGtxaFo2MXE7OT5TVU4hbTQiNVRjS2hpImx0UzZicSk8LC0jQ15CX3JAMFR5aWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5rVypuOE5GXmBIai1Sdm1bRnRkSWUnLztQdSQ7eHQpMVxjLHEhLj4+OzVJR2xdda:T748,ZSk9XSlNUFlgRXxTR21hQ21dZEZfbVQ7Z3x4QkY4e2BONitvU2s4Ll9ZcGpDfnhaOGdpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLnBzYVUzVDllWml0NWUoZDlEXWtSWUZTUVlDXFoueWdmdb:T748,RU5AdCtnRFJYKT82QiM9NV97RHpmJVosel0nQyNKRkI3Um1lZm1nQHgxaHxvMH08Y2JpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLkhtKkR2MDE/UUYuOHF3aHBYfSQsaVZncyl5ckN3Yg==dc:T77c,bTlEM20qOHEnRk15fCA9KklWeHA2O24/W2FDOXNIKy4+anE8NXElfGZYPSohcDlUOlJWNGtqbS9AZnAscFVCdHJ3WV1VQlVzKUQgNEVfc3xQfV0oZmwuKUZmLyhpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLlBaZjFyKzJ8KzpJImkrPSlqK0lVSjZiRHFwJA==dd:T77c,TTpqKHpRIip8cnJNVjNaR0NobzJaVjRiZU1DJSQ9OmghaVUwTnBlQExDOFU9MlZPRDV8bldbNURvY004ZEszQD45bltEN2YjbWNxc2lZWm5bcVRnaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5pPzBJNHdQXjR6IW1bd1RTOS1AJGU3fkUhRWUuTCVrOVJvLyM=de:T75c,bzhFRk1LMT5cWyVEdWJwKiA9WFJZaSpETmlYVl0pbkp4JFNsP35hQW42TXxIc088cydTeEg2dWl9TGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuKXBoPjx2S1hqSjMzcW9dVCgwa3NdR09DdHZHNip4cyw2Z1E1eyN3df:T75c,UDQ6W0JYe2RjXEZiOW97PV1vfiZvOTdLdVE9MHs+Kk5lZXduRSslfmFJWXZBS3std1d2TGYhX0t5UmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuNzNxfl5NIFc8SHZZazYjLWVBdGk6WV1fS1lbRDg1XTFubVllVj1fe0:T750,c1xSUC52P3h9Wi1pLX5QbSl6a3k+a3JiSWdYPyR2NjJpfVp4MmMkUVdAeXktcFw9a2NAWUJMJixfdld+K2QtVGgtMGlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UufDMyQEc1OlQySmtEQEs/YUJ5R347e1:T764,U2BxTWwxYWp+OGZqRmJ1Jn5QTmR+N3hya3ApZyFsW11gPH06XHk8ZjVdSXddRS5BVWkkIylrQ1NrYm47TUlYSW9NPDZRVil9O3J8JklaRnZvLCFpbGVzIG9yIGFjY2lkZW50bHkgY29ycnVwdCB0aGVtIC0gaW4gdGhpcyBjYXNlIHdlIHdvbid0IGJlIGFibGUgdG8gaGVscC4zLiBUaGUgc2VjdXJpdHkgcmVwb3J0IG9yIHRoZSBleGNsdXNpdmUgZmlyc3QtaGFuZCBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3aWxsIHJlY2VpdmUgdXBvbiByZWFjaGluZyBhbiBhZ3JlZW1lbnQgaXMgb2YgYSBncmVhdCB2YWx1ZSwgc2luY2UgTk8gZnVsbCBhdWRpdCBvZiB5b3VyIG5ldHdvcmsgd2lsbCBzaG93IHlvdSB0aGUgdnVsbmVyYWJpbGl0aWVzIHRoYXQgd2UndmUgbWFuYWdlZCB0byBkZXRlY3QgYW5kIHVzZWQgaW4gb3JkZXIgdG8gZ2V0IGludG8sIGlkZW50aWZ5IGJhY2t1cCBzb2x1dGlvbnMgYW5kIHVwbG9hZCB5b3VyIGRhdGEuNC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLmwobUJCZ2NsOz5jMH5SWT0tdT44e2:T774,VSQnRWlza2hneWVYeCFnTm5IXVd1OHhCOmBpWDJpOEI2YjgiTjI0IEdYMzMlbTIxNSFkL0M4LUBwaUFLbHxAMVtDSE9ZWiwgZGJTOzc3L1ZMPko5WGgkXlkpV1JSaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS5zQk1LUVxNckksbiFaXXomdzhPdw==e3:T760,dWJFUlpBSW90ZCpXTVlNKDR5cV06SzZ+M2ApeXtRbkolPj1zfXBvWCNsQC94Xj01J0toP2whJ3ogWmZfXStCTEJFaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAuMy4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLjQuIEFzIGZvciB5b3VyIGRhdGEsIGlmIHdlIGZhaWwgdG8gYWdyZWUsIHdlIHdpbGwgdHJ5IHRvIHNlbGwgcGVyc29uYWwgaW5mb3JtYXRpb24vdHJhZGUgc2VjcmV0cy9kYXRhYmFzZXMvc291cmNlIGNvZGVzIC0gZ2VuZXJhbGx5IHNwZWFraW5nLCBldmVyeXRoaW5nIHRoYXQgaGFzIGEgdmFsdWUgb24gdGhlIGRhcmttYXJrZXQgLSB0byBtdWx0aXBsZSB0aHJlYXQgYWN0b3JzIGF0IG9uZXMuIFRoZW4gYWxsIG9mIHRoaXMgd2lsbCBiZSBwdWJsaXNoZWQgaW4gb3VyIGJsb2cgLSBodHRwczovL2FraXJhbDJpejZhN3FnZDNheXAzbDZ5dWI3eHgydWVwNzZpZGszdTJrb2xscGo1ejN6NjM2YmFkLm9uaW9uLjUuIFdlJ3JlIG1vcmUgdGhhbiBuZWdvdGlhYmxlIGFuZCB3aWxsIGRlZmluaXRlbHkgZmluZCB0aGUgd2F5IHRvIHNldHRsZSB0aGlzIHF1aWNrbHkgYW5kIHJlYWNoIGFuIGFncmVlbWVudCB3aGljaCB3aWxsIHNhdGlzZnkgYm90aCBvZiB1cy5JZiB5b3UncmUgaW5kZWVkIGludGVyZXN0ZWQgaW4gb3VyIGFzc2lzdGFuY2UgYW5kIHRoZSBzZXJ2aWNlcyB3ZSBwcm92aWRlIHlvdSBjYW4gcmVhY2ggb3V0IHRvIHVzIGZvbGxvd2luZyBzaW1wbGUgaW5zdHJ1Y3Rpb25zOjEuIEluc3RhbGwgVE9SIEJyb3dzZXIgdG8gZ2V0IGFjY2VzcyB0byBvdXIgY2hhdCByb29tIC0gaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvLjIuIFBhc3RlIHRoaXMgbGluayAtIGh0dHBzOi8vYWtpcmFsa3p4enEyZHNyenNydmJyMnhnYmJ1Mndnc214cnlkNGNzZ2ZhbWVnNTJuN2VmdnIyaWQub25pb24uMy4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQuS2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS56dy0/byM+QXpmOmc6PTV7QHRHanB9V0R1Sld+ckBSLl0pe4:T744,diQiWTE+cEJCXEJZPm9HUzt+Xz9iSHV+U3wiSG9AYlVMVil3fDliITA7RktycTRWQ1wgNXRBPmlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuOVJNImlPK0ZGKEY7MylUOllZI0JYKU0=e5:T78c,WFYwMG85I0gzJ1wsTkpdIGU4PyRPMD5XT0J9RjZ8Z2MnM1Jtd35hXVx7RWkocDx6JGdESzlSJChmL2NAKE5APSk5c3J5UFdqIS1CdH41eSJIcFdSNylxSyBHJC0sXWlsZXMgb3IgYWNjaWRlbnRseSBjb3JydXB0IHRoZW0gLSBpbiB0aGlzIGNhc2Ugd2Ugd29uJ3QgYmUgYWJsZSB0byBoZWxwLjMuIFRoZSBzZWN1cml0eSByZXBvcnQgb3IgdGhlIGV4Y2x1c2l2ZSBmaXJzdC1oYW5kIGluZm9ybWF0aW9uIHRoYXQgeW91IHdpbGwgcmVjZWl2ZSB1cG9uIHJlYWNoaW5nIGFuIGFncmVlbWVudCBpcyBvZiBhIGdyZWF0IHZhbHVlLCBzaW5jZSBOTyBmdWxsIGF1ZGl0IG9mIHlvdXIgbmV0d29yayB3aWxsIHNob3cgeW91IHRoZSB2dWxuZXJhYmlsaXRpZXMgdGhhdCB3ZSd2ZSBtYW5hZ2VkIHRvIGRldGVjdCBhbmQgdXNlZCBpbiBvcmRlciB0byBnZXQgaW50bywgaWRlbnRpZnkgYmFja3VwIHNvbHV0aW9ucyBhbmQgdXBsb2FkIHlvdXIgZGF0YS40LiBBcyBmb3IgeW91ciBkYXRhLCBpZiB3ZSBmYWlsIHRvIGFncmVlLCB3ZSB3aWxsIHRyeSB0byBzZWxsIHBlcnNvbmFsIGluZm9ybWF0aW9uL3RyYWRlIHNlY3JldHMvZGF0YWJhc2VzL3NvdXJjZSBjb2RlcyAtIGdlbmVyYWxseSBzcGVha2luZywgZXZlcnl0aGluZyB0aGF0IGhhcyBhIHZhbHVlIG9uIHRoZSBkYXJrbWFya2V0IC0gdG8gbXVsdGlwbGUgdGhyZWF0IGFjdG9ycyBhdCBvbmVzLiBUaGVuIGFsbCBvZiB0aGlzIHdpbGwgYmUgcHVibGlzaGVkIGluIG91ciBibG9nIC0gaHR0cHM6Ly9ha2lyYWwyaXo2YTdxZ2QzYXlwM2w2eXViN3h4MnVlcDc2aWRrM3Uya29sbHBqNXozejYzNmJhZC5vbmlvbi41LiBXZSdyZSBtb3JlIHRoYW4gbmVnb3RpYWJsZSBhbmQgd2lsbCBkZWZpbml0ZWx5IGZpbmQgdGhlIHdheSB0byBzZXR0bGUgdGhpcyBxdWlja2x5IGFuZCByZWFjaCBhbiBhZ3JlZW1lbnQgd2hpY2ggd2lsbCBzYXRpc2Z5IGJvdGggb2YgdXMuSWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczoxLiBJbnN0YWxsIFRPUiBCcm93c2VyIHRvIGdldCBhY2Nlc3MgdG8gb3VyIGNoYXQgcm9vbSAtIGh0dHBzOi8vd3d3LnRvcnByb2plY3Qub3JnL2Rvd25sb2FkLy4yLiBQYXN0ZSB0aGlzIGxpbmsgLSBodHRwczovL2FraXJhbGt6eHpxMmRzcnpzcnZicjJ4Z2JidTJ3Z3NteHJ5ZDRjc2dmYW1lZzUybjdlZnZyMmlkLm9uaW9uLjMuIFVzZSB0aGlzIGNvZGUgLSAxNDk3LVBOLUxJUFgtVkxUQiAtIHRvIGxvZyBpbnRvIG91ciBjaGF0LktlZXAgaW4gbWluZCB0aGF0IHRoZSBmYXN0ZXIgeW91IHdpbGwgZ2V0IGluIHRvdWNoLCB0aGUgbGVzcyBkYW1hZ2Ugd2UgY2F1c2UuJnYuLm5lSGpJMiJJUCVMc0dgZmgqT35TSDdIaTh9NW93eF9EaA==e6:Ta53,Hi friends,Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"65a2c49a115f01251309376b","environment_id":160,"environment_description":"Windows 10 64 bit","size":1029120,"type":"PE32+ executable (GUI) x86-64, for MS Windows","type_short":["peexe","64bits","executable"],"type_short_id":"64-bit exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"win.exe","md5":"7ca94d84f4a02fb1f608818c1c3ab62d","sha1":"abb636c27bf719e18d52d25bde30650534fc247b","sha256":"2727c73f3069457e9ad2197b3cda25aec864a2ab8da3c2790264d06e13d45c3d","sha512":"153bcd7877dccec163c48b16d34827d514ecac17880c2607a6798fd1a51f18025fcad79dad8c595756062cf95ddbd3b54f604cb2502883ff0594ea09b39ddd1a","ssdeep":"12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmhj:wbyxv9XQ7B3oWI+XHW6y4r","imphash":"532604173dfc1c3c405b32fcda84ad33","entrypoint":"0x1400855b8","entrypoint_section":".text","image_base":"0x140000000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","LARGE_ADDRESS_AWARE"],"dll_characteristics":["TERMINAL_SERVER_AWARE","DYNAMIC_BASE","NX_COMPAT","HIGH_ENTROPY_VA"],"major_os_version":"6","minor_os_version":"0","av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2024-01-13T17:12:58+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":null,"certificates_validation_message":null,"domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":3,"total_signatures":155,"extracted_files":[{"name":"__PSScriptPolicyTest_doe4olli.wci.ps1.228370578.akira","file_path":null,"file_size":513,"md5":"d5db41f2a6faeb8bbc4f7581eb5854c8","sha1":"88c7b178f1fe62ec997d9d123dd873fecf74d2c3","sha256":"5ab24d25e6286cc382e5d04289bae76c334d4a9e987ab27e8921b2ee1e2e68b2","sha512":"db1275032633a7a5cd9978c4b7fcb6c8333db65c32ec78e344ea0c69f3a746e09c2f0b92a25d2bf5d9caf10e74a57c2eb9e1a8e17dd840981f717684dda1f448","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=cc731bbe61f3eaebe2e2b056adb474a31c3d50c3fd591f95e2d8c6521d4643961b056b9201de2362935bc724361c8496d16f17e66bb698200609319d8182b8c2fe1ab43fe6b04c3399032a639f4fc9f9c7926bf82398bc241bcc8f4483ff0897905b4b3e67","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=cc731bbe61f3eaebe2e2b056adb474a31c3d50c3fd591f95e2d8c6521d4643961b056b9201de2362935bc724361c8496d16f17e66bb698200609319d8182b8c2fe1ab43fe6b04c3399032a639f4fc9f9c7926bf82398bc241bcc8f4483ff0897905b4b3e67","has_overview":false,"extended_details":null},{"name":"network_original.pcapng","file_path":null,"file_size":1533500,"md5":"e3c7092203e8ba1b91bcfca3cbeff3fc","sha1":"7e29aeff8229c849a5fd42d8a42dbbe6320c28f9","sha256":"75722e81392bf2a3613048772f1e771af684fb63929b678a996daca4941a48d8","sha512":"d32244321cf76b402c7e83414f3248b06f18948fa59812a43441021d7ba33930f527c2325407ca8366e2cb0056ab2b86f9ea6d24a1613ce29a44f2cd8dc5fbca","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=336580f7e3983a1c2fd6debfa3895262ee6c06fe4107487eddb715256b677ffd749d9cb41ad91f3fbb1daab1cf0212affff29819ade3b35c1e291f90c5036dd011222f48cffe3044375266f631266da02a","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=336580f7e3983a1c2fd6debfa3895262ee6c06fe4107487eddb715256b677ffd749d9cb41ad91f3fbb1daab1cf0212affff29819ade3b35c1e291f90c5036dd011222f48cffe3044375266f631266da02a","has_overview":false,"extended_details":null},{"name":"Log-13-01-2024-09-15-40.txt","file_path":null,"file_size":74035,"md5":"c2ba24137532428e18b14b03d711ed73","sha1":"4ec9e3e234e9a237edf20e2b1fe3f2c55df16233","sha256":"809dcd6ac39679abac3e3a57d25015c3b21eb5a1556a2dfcc1eb65ab75e692a8","sha512":"e4cc65cda6664dd3abc257e3363199ef779c9731b24dba292c63b4fd5f77933357fcf202f769b7a234a96c2793cdfd4548bb6141d2fc8858c03bafa9d02795a1","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=c5827f74670d313591fcee697ac68727616a13f56658d95ae5eaa5f4b4b14d829d195bae77133394bb62c70033bbc7bb5bfe091b8216dba0cd7cc5bee604489d63289d8deee73055ce2f971ca72367eceb245d0b3c","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=c5827f74670d313591fcee697ac68727616a13f56658d95ae5eaa5f4b4b14d829d195bae77133394bb62c70033bbc7bb5bfe091b8216dba0cd7cc5bee604489d63289d8deee73055ce2f971ca72367eceb245d0b3c","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.3040952710.akira","file_path":null,"file_size":3209,"md5":"b9b12baa80e34e92a957678a2d11077f","sha1":"67aaf17a7ff6467c874275f4b6f1a30c98e4fdc4","sha256":"098b78ac5ae5656e6153469e57e5c4a13f76b44c856ff121bf8b1f9175fa77d9","sha512":"27c2e4c1d67d43934f470f1e3b68c20df2713ed004228613c55faa44d30069d6b59024d47b93e596b7dad6bc29f693ddf78207bd9b6aa13b6fb3dae0d195005b","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=2c62474dfb7ebbcb7720749f55b58efb6997feba28a4857ea698fadada74dda00ec90d9788f3d69b8e69f7780a9bfd1db8ac8e11311324c1d66768935f7e6cf68be0ba093b50e85c2911766496f5e125e3","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=2c62474dfb7ebbcb7720749f55b58efb6997feba28a4857ea698fadada74dda00ec90d9788f3d69b8e69f7780a9bfd1db8ac8e11311324c1d66768935f7e6cf68be0ba093b50e85c2911766496f5e125e3","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.20853543.akira","file_path":null,"file_size":3209,"md5":"32aca7d5e1fd64bdeda8a75d1c177c47","sha1":"6684c0494b374ec8691879dc6f5a7a8164fdd177","sha256":"89f071284b82751cf3898d9f3b536a2353865a8532d78b41f83ff65a4bb5fa2f","sha512":"9ece5649486440e779dab8dc4c8db47eef68055643359f74914d47dad398d5487f78736830a3c1ed4ce35b051a374bc6ca3eb92c639d38766e68de8681fa4a57","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=1261d2bf9dae1b9850036e4c83dc58e1fb28c4818e5852b0ff7d0d635e6365821018973674dd02bcd2887535d01dccfd780fac4102f3089e1855d2b05a353b8169dd160433a6d349ea6077d6344b8e","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=1261d2bf9dae1b9850036e4c83dc58e1fb28c4818e5852b0ff7d0d635e6365821018973674dd02bcd2887535d01dccfd780fac4102f3089e1855d2b05a353b8169dd160433a6d349ea6077d6344b8e","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.2595553418.akira","file_path":null,"file_size":3209,"md5":"eca1ae502011b1c08f82d081df7151a6","sha1":"9a5a7ab06bd37265eca412c3a3276c4f823c153c","sha256":"308b0c90ba546be4c4ab7de538d9dcab783599577ac9a92238a041afbe7eda2b","sha512":"dbcbd22629d8f133e3dbb9ff91ab2b433417538f61020d987e573d1ef0950972a16691ffbc9aa217feb0aaaff593f943239cd6a9459e13d3f046a23cee2544ac","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=c55b89c95ff7b4dbc7e2f6e4388b9cabc619e3156e44fece84220dc2bba8191005d7937874168fe8d5b3f607ae93951c5a1a7c60343fca8e1b75a5efbcfa9d69278af03a3aa5d1006b4d7b0436a21c6de8","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=c55b89c95ff7b4dbc7e2f6e4388b9cabc619e3156e44fece84220dc2bba8191005d7937874168fe8d5b3f607ae93951c5a1a7c60343fca8e1b75a5efbcfa9d69278af03a3aa5d1006b4d7b0436a21c6de8","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.4196251165.akira","file_path":null,"file_size":3209,"md5":"327f9d101871091ca40b1036a498c30b","sha1":"dc756c6d1c2d6dffb7128d6343229f4911b89a20","sha256":"ca4483616b4547db0a7df4629e3b30a66227bf4429ec59be12593e08378f0024","sha512":"3c742f88c2fc5b50b75668fffa2379467cfbcb868133a351176102de81f163fdb255dad7ad34b01a4543a2a5e81f36f89a31228933993bdca243dfdb2f7cf255","type_tags":["unknown"],"description":"PGP Secret Sub-key -","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=d508e73178d300a4115b295557ccd7f20351b39f859acec7eeb3edc5b709b0e4765c59ddcd70f59c66c360e5897d5b52674e84fffaa7249daeb60e10c8cf8201021db7662f74b6e1a36d8a35fcf2939770","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=d508e73178d300a4115b295557ccd7f20351b39f859acec7eeb3edc5b709b0e4765c59ddcd70f59c66c360e5897d5b52674e84fffaa7249daeb60e10c8cf8201021db7662f74b6e1a36d8a35fcf2939770","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.3969180676.akira","file_path":null,"file_size":3209,"md5":"62d9848d8a657450e3da353a6a0bec1c","sha1":"1478e8c0745a623b8f17f072747da0f93758d5be","sha256":"b8be29f5a8ef36ac54868b66c71e3fce6f7f96bb8744ec3b4aaa7882c137faa5","sha512":"98b3cec1d74f440189d31d0a0f56f2eec4876e563eeed2c87681ba28d0c59f4b3fcc3931a65c7924f26d2179ca009ca16b7178f57a4b0827ffb54ac962187a38","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=82ce2e8b661f49cf0344037acbd084beaf727752585501c1b5d758c5e543af202d66bce47ce3761016b049ac723b78085dd0b6aa9134da7a74d62a86799fc2c1215c96a0df6403117e42bd3ad2a30706ac","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=82ce2e8b661f49cf0344037acbd084beaf727752585501c1b5d758c5e543af202d66bce47ce3761016b049ac723b78085dd0b6aa9134da7a74d62a86799fc2c1215c96a0df6403117e42bd3ad2a30706ac","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.666507834.akira","file_path":null,"file_size":3209,"md5":"73038fab764173c3696d0e3218730010","sha1":"706545739f66c50b81f85fbaaa0cd66ce5afd357","sha256":"5ab87e774ad74afd4bf624b0d41c1b9de41299d44cb48593a2d66bd93dd60a4c","sha512":"b0f66cb68ca104789f79948aaed55b529df87e4d434c1e24c893348dfba5a23454f16847b18acd5c678b08dabf8999e120f2a9dde67b7b5ac70b90677b01208e","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=5e19da5367228f3dcc0c7ba4057f74a4e9a437fadd4352665b3448cabbd767040ac396627e00f1d98b0071d1b06e0f90b5004cf2545624f3048ae43528e6ad232c20d20c2bb6f90a4230f677b54875f2","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=5e19da5367228f3dcc0c7ba4057f74a4e9a437fadd4352665b3448cabbd767040ac396627e00f1d98b0071d1b06e0f90b5004cf2545624f3048ae43528e6ad232c20d20c2bb6f90a4230f677b54875f2","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.3790783025.akira","file_path":null,"file_size":3209,"md5":"9c6c8bff23a18e2ed1fdd54f203ce41b","sha1":"315ade74ad60b3072bfff2dc73da3b766ae88b0e","sha256":"aa988b6febbd7aea98976f506292dab7ece69ec771596bb0536ee0a6bd9e9f9d","sha512":"9cf70f59a0ea1de5fdf8e2052a03cf5156f6f930aa598cfc6e117d1099bc7139af4ba4d97735a0df420bd963ea94ba491ce01b5dc4026a9f9d4c0d4b006cfdf3","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=5e092332274f4df6de1a90a690c7adac44f27f637a6cf29118070b8f095f133f8e4fc3007366e2772184d0ed216c1f79e2b23e6dd5e39ed31410a3cd53591b535def00eb8bf015897b8a544cc86f37019b","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=5e092332274f4df6de1a90a690c7adac44f27f637a6cf29118070b8f095f133f8e4fc3007366e2772184d0ed216c1f79e2b23e6dd5e39ed31410a3cd53591b535def00eb8bf015897b8a544cc86f37019b","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.2144647933.akira","file_path":null,"file_size":3209,"md5":"598f107c5ede8c8cfa803e64ffe7ba2e","sha1":"dab3103f0428478299be10aedded93bb92a4191e","sha256":"ca5460988f0918b2d0a05f09237ee0b2ffef43215d6c476989e63c5ad840bf25","sha512":"6c5edbdcc88ef2b44679064c52b5e8d9f5ab5cb6e7c30a35b2093e8628dc93c0fe19b61093d3b35cd8e40d901cddac5f8bbad440d7d4c6035a5c052109967ca0","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=924d2457e231c5b751932b0016998b8bbde92d01eaf2304d0324e64c4683d25df529c07bc7701fedaffc7e5a53dd8bdbd521c80d8e2099b95a9de00f4f78e0475c39f0394507ba4ff2313d25c0cb2daeef","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=924d2457e231c5b751932b0016998b8bbde92d01eaf2304d0324e64c4683d25df529c07bc7701fedaffc7e5a53dd8bdbd521c80d8e2099b95a9de00f4f78e0475c39f0394507ba4ff2313d25c0cb2daeef","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.3946409587.akira","file_path":null,"file_size":3209,"md5":"0cbedcf4287e9357d191101cfadadffb","sha1":"52aa17735346cb64d0547f3adf3d1b9da3449f82","sha256":"01891a0a572988bb61f3d7f3689968a596d622d54a899b38923fb52f46745fad","sha512":"d97379e68363ed53dd8e3431e7359f7d041e5dbac6e3edb60730b68c52d354ee60590f7eacd51410549e42325b7b0c2085a7a9e510083bef586f588d10bd8222","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=e3fa6b9d79859c7ef9d4ac4315183a6e2021381c0191ba7dbd0e0826ea3d1799a374ed11121a7950e7487657d8fa7006fcc31f8e95bcf42d99b371381833b02e1011abcc4ac6fdb1b3e6f84ea2cd0b27f5","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=e3fa6b9d79859c7ef9d4ac4315183a6e2021381c0191ba7dbd0e0826ea3d1799a374ed11121a7950e7487657d8fa7006fcc31f8e95bcf42d99b371381833b02e1011abcc4ac6fdb1b3e6f84ea2cd0b27f5","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.2181991362.akira","file_path":null,"file_size":3209,"md5":"192f62532f0aeb53d7b4d5942674a83d","sha1":"188bb83cfbdf57f799f6a12174efc47d3e3eab3a","sha256":"497c90c162ddeb0fad31b24753da30dfc496ad2fb01549513a40cabdcc6003eb","sha512":"e4baa8201af05d29ff8be041a371ccb04c9ad1ef84935e8c8aaf38c30680a281aac817061523e2d9603f05c73a408d280985c0a999a96b1c7ac9df2563f3fa40","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=9e27752ab01f0bc808fedb9f7cbc75fe64af6e34b211c9d15f745a860eeee2a234e4619dc7200a36d8103cfd276be4535be5760df9c1932b39d38599ed6e04dc66e763975e0c64fed7993b41ec1246eafb","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=9e27752ab01f0bc808fedb9f7cbc75fe64af6e34b211c9d15f745a860eeee2a234e4619dc7200a36d8103cfd276be4535be5760df9c1932b39d38599ed6e04dc66e763975e0c64fed7993b41ec1246eafb","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.1221958341.akira","file_path":null,"file_size":3209,"md5":"6eaeb7306e87e0cb931c6058c5f12757","sha1":"dc0a125ed95fc0d26eaea3614df37cdd2c71cfb2","sha256":"60acf963075da70773386f5cbae94452bbaf55f8d85cd3ef2c4a3144a61fd0cf","sha512":"325fe102b1add15f6d65a9bead8641c37001d762eadd81fe9dcf8081234c8a29bbcad9d0b1ddaad8461c17d1706b85d3812ed7a34420c9dba1c9a88cd0464fda","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=e897a4b09ca45c67218932febd7804350204a7d5077e2585abfc43811325efd08773a80d2e87a2ca363162ec785e0a7eb6f22408eb444f2cf823c65bad6e63b91709a25ed0a82ab380902445b6b1865c0b","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=e897a4b09ca45c67218932febd7804350204a7d5077e2585abfc43811325efd08773a80d2e87a2ca363162ec785e0a7eb6f22408eb444f2cf823c65bad6e63b91709a25ed0a82ab380902445b6b1865c0b","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.2006426956.akira","file_path":null,"file_size":3209,"md5":"9bf570a4d72f345861bd101c6fdf7cb4","sha1":"a285bfb93ba05ef1a820ead2eec369879b177f6c","sha256":"ce28058c1723545e5fea25806b04b514e2bfbc01e69439a5e245d31e635120ac","sha512":"573dbc3995021e473387da50fc143fd65cc14a94e1cc689625e851853ac866170c8b4b2e7802d4591200473740f6aa9ed5510fe7e967b2a796462b8c5f8e7204","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=b318d958cd381bf3ad19a97a9d576b667388323554330a35c480c264500b3801762b0180028a1c221ff3f373668f0d76c2c82e780f1866d0b6922bc06657990e7b09851bb08c2c10d98da4411465a61cd1","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=b318d958cd381bf3ad19a97a9d576b667388323554330a35c480c264500b3801762b0180028a1c221ff3f373668f0d76c2c82e780f1866d0b6922bc06657990e7b09851bb08c2c10d98da4411465a61cd1","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.1350744551.akira","file_path":null,"file_size":3209,"md5":"985f83566bd23070e1e8fde0aee37171","sha1":"c70e8af951c9844ac6984689c39e23735bc8c80b","sha256":"546ecee6f2c8a8f3d1ac14263cc30c601ebde0a195442c5892d07eb3e3c357b6","sha512":"e5be290ec76dd653949dd4385cba810aee779c71c473f240a58a448e26fdc0e0bc763ee16207e27ae08fe73123e0b03aead361acf75a8afa016d0aae415e0c9a","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=f208c25e7ea97d1d5e245c021073d7cfa5239c41db6aae8a55625efd604c42abb2d15aa05559c09ff8274cb14e88894741f8f165e5ed7c62fe465ae17844d00d2668e61f79589646bbcef2bf0b9d5e87fd","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=f208c25e7ea97d1d5e245c021073d7cfa5239c41db6aae8a55625efd604c42abb2d15aa05559c09ff8274cb14e88894741f8f165e5ed7c62fe465ae17844d00d2668e61f79589646bbcef2bf0b9d5e87fd","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.1717193171.akira","file_path":null,"file_size":3209,"md5":"e965c584ac349f909f43f8a5e0455bd5","sha1":"6b6998517a4c17dfc928cfd9ce92b8d6d902a822","sha256":"1e3ba22020ce0a897ea2d53c76d19ba726558d8ddc2bbeedace72508fd34d1ea","sha512":"b5433c035e1e2e45498bb0bcf2ebc70f928479827e2875c78883dc4b45a2fba3fafd98c2fb6531690ed230f7c57aab07025e98789ebe7396cc5030f2793d6b9e","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=edd5508099e861925d609672c016b4793d382bf75943ea807d7a42154f0a1239285a9d8458c4e8a7784f3754e951efbe603ae15a1eda39045791d7ae63af75c722643685ce3f0528ced4fcbfcaf734f8c5","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=edd5508099e861925d609672c016b4793d382bf75943ea807d7a42154f0a1239285a9d8458c4e8a7784f3754e951efbe603ae15a1eda39045791d7ae63af75c722643685ce3f0528ced4fcbfcaf734f8c5","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.2564684880.akira","file_path":null,"file_size":3209,"md5":"b1e7249140b533590e464be697b5cffc","sha1":"a6a6fd7c20d716b606bc654feae89be6032152b2","sha256":"41dd87b4db219af081dc3db12485c188db02bb4d4e888d0ba2ca9efda78c444c","sha512":"2e4d2bf1913006690ac0ee9da1be80a71cf39894d1a58f270233aa7da5b7127070110529839bc141874f024809bb0f38fe3643043eafdf64b346b07721fc8825","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=5e9b810d31c159b0ddefac095848a35ea04ca03adf292df252085abd9b6acc83e2c4d64bd65cc0ab69c51e86895b75dc206448a29bcaa5fb2afd40e96fec984e8d14082d2d213d38acfde71a3ce0998d29","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=5e9b810d31c159b0ddefac095848a35ea04ca03adf292df252085abd9b6acc83e2c4d64bd65cc0ab69c51e86895b75dc206448a29bcaa5fb2afd40e96fec984e8d14082d2d213d38acfde71a3ce0998d29","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.442292584.akira","file_path":null,"file_size":3209,"md5":"db41830d37979c399e4c1d2b2dc591c7","sha1":"4657b947a5db5936f09abd354ce4e982991adb01","sha256":"36b2e050ac6aec147b48b02bb216509dbbfae80237231af50b0abbe79f676845","sha512":"9dd5ed1d926b64afb35de09f5e8359897b94894eef9c759518eb15a8b830baef4332b42106101d67da4c312a341f651126fbed6d0695fa9b63524997a280cc4e","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=4f0a31d3bbb189011f98979b9c2ca14fa7e6eb4b88fa2cde7516446737624f0b3225ba7b4dc0b294f217c8773d81b69c9d6504727eb4666f2d71e54d0c63b10a708e187c80f013197e15191fb99f9e18","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=4f0a31d3bbb189011f98979b9c2ca14fa7e6eb4b88fa2cde7516446737624f0b3225ba7b4dc0b294f217c8773d81b69c9d6504727eb4666f2d71e54d0c63b10a708e187c80f013197e15191fb99f9e18","has_overview":false,"extended_details":null},{"name":"akira_readme.txt.3233341502.akira","file_path":null,"file_size":3209,"md5":"a18d7e9635e9c8e768532b19912e3f04","sha1":"9c5a551597c90fa24ef2e06a69d034b6bfc6a851","sha256":"c1f8c66f9135cf96289d116232326db647be367633f041812f7f2cd3ec483c74","sha512":"59d2a2af389f51872f38ed7cc0e9b33cd65a43a428a15669903750f063d14c5a6b04fd44243dd14d2d50e02ac86f1d04f9ec418855150b10db8de9f7a397e9e4","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/65a2c49a115f01251309376b/download/dropped-file?key=a583f8d7c68cc285ac20223ef04872235bdc563a2b47b5cd5d1944e48bf050de6f479ffeb900e906e92328298c1d7f0b19718932b1f0bae51c296731b53618efa92c1cfd1ee5e8e21cc0a0822eb2a63055","submit_link":"/bff/report/65a2c49a115f01251309376b/submit/dropped-file?key=a583f8d7c68cc285ac20223ef04872235bdc563a2b47b5cd5d1944e48bf050de6f479ffeb900e906e92328298c1d7f0b19718932b1f0bae51c296731b53618efa92c1cfd1ee5e8e21cc0a0822eb2a63055","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 32822)","9 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 32822)"],"imported_objects":["100 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 32533)","23 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 32822)","3 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 32822)","10 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 32533)","16 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 32533)","1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 27412)","179 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27412)","19 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27412)","6 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 27412)"],"file_analysis":["File contains Visual Basic code","File appears to contain raw COFF/OMF content","File is the product of a small codebase (9 files)"],"total_file_compositions_imports":19},"processes":[{"uid":"00000000-00006712","parentuid":null,"name":"svchost.exe","normalized_path":"%WINDIR%\\system32\\svchost.exe","command_line":"-k unistacksvcgroup","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","av_label":null,"av_matched":null,"av_total":null,"pid":"6712","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00007060","parentuid":null,"name":"sedsvc.exe","normalized_path":"%PROGRAMFILES%\\rempl\\sedsvc.exe","command_line":null,"sha256":"1bc49171277e8540e3affbad12e88c9999ad3e3b37b0ac46a578fd1b07f676c4","av_label":null,"av_matched":null,"av_total":null,"pid":"7060","icon":null,"process_flags":[]},{"uid":"00000000-00006460","parentuid":null,"name":"sedsvc.exe","normalized_path":"%PROGRAMFILES%\\rempl\\sedsvc.exe","command_line":null,"sha256":"1bc49171277e8540e3affbad12e88c9999ad3e3b37b0ac46a578fd1b07f676c4","av_label":null,"av_matched":null,"av_total":null,"pid":"6460","icon":null,"process_flags":[]}],"mitre_attcks":[{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":9,"informative_identifiers":["Contains ability to create/open files (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to execute Windows APIs","Contains ability to load modules (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Calls an API typically used to retrieve function addresses","Imports GetCommandLine API"],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains references to WMI/WMIC"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve the command-line string for the current process (API string)","Contains ability to executes commands or batch file"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to schedule tasks using COM objects"],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to open a service (API string)","Contains reference to multiple windows system processes"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL","Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"],"parent":null},{"tactic":"Execution","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries COM task scheduler class object"],"parent":null},{"tactic":"Execution","technique":"Component Object Model","attck_id":"T1559.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1559/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559"}},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1547.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create a service (API string)","Contains the ability to modify system service (API string)","Contains ability to start a service (API string)","Reads service groups entries related keys"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to schedule tasks using COM objects"],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries COM task scheduler class object"],"parent":null},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Kernel Modules and Extensions","attck_id":"T1547.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create a service (API string)","Contains the ability to modify system service (API string)","Contains ability to start a service (API string)","Reads service groups entries related keys"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Reference explorer.exe process","Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Scheduled Task","attck_id":"T1053.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to schedule tasks using COM objects"],"parent":{"technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053"}},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries COM task scheduler class object"],"parent":null},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete a property and its value from an item (Powershell command string)"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)","Queries kernel debugger information"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delete files/directories (API string)","Opens file with deletion access rights"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Reference explorer.exe process","Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains CRYPTO related strings","Contains ability to encrypt/encode message (API string)","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","YARA signature match - AES Encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attck_id":"T1553.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to disable driver signature enforcement"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Contains ability to create/load registry keys (API string)","Contains ability to delete registry key/value (API string)","Writes registry keys","Modifies Software Policy Settings","Accesses System Certificates Settings"],"parent":null},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Renames files"],"parent":null},{"tactic":"Defense Evasion","technique":"Double File Extension","attck_id":"T1036.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Renames files with double extension (often done by ransomware)"],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to read files (API string)","Contains ability to enumerate files on disk (API string)","Tries to access non-existent files (executable)","Contains ability to verify if file exist on disk (API string)","Reads files","Touches files","Tries to access non-existent files (non-executable)"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to query system locale (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":17,"informative_identifiers":["References to WMI query strings used for information discovery","Contains ability to find logical drives of the machine (API string)","Contains ability to retrieve specified item(s) (Powershell command string)","Contains ability to determine disk drive type (API string)","Contains ability to retrieve a module handle (API string)","Contains ability to retrieve information about the current system (API string)","Contains reference to mutex-related activity (API string)","Contains ability to retrieve the OS information (API string)","Calls an API typically used to get product type","Contains ability to read software policies","Queries volatile registry keys","Calls an API typically used to retrieve OS information","Reads information about supported languages","Calls an API typically used to retrieve computer name","Calls an API typically used to get system version information","Reads the active computer name","Reads the cryptographic machine GUID"],"parent":null},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve network parameters of a computer (API string)"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)","Queries kernel debugger information"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Contains ability to retrieve process ID (API string)","Contains ability to retrieve/open a process (API string)","Queries process information","Opens a handle to the specified process","Queries basic information of the specified process","Calls an API typically used for taking snapshot of the specified processes","Process launched with changed environment"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains registry location strings","Contains ability to query registry keys (API string)","Monitors specific registry key for changes","Opens registry keys","Queries registry keys","Accesses Software Policy Settings","Reads Windows Trust Settings"],"parent":null},{"tactic":"Discovery","technique":"System Network Connections Discovery","attck_id":"T1049","attck_id_wiki":"https://attack.mitre.org/techniques/T1049","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to enumerate network resources (API string)"],"parent":null},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Possibly checks for the presence of an Antivirus engine","Possibly tries to implement anti-virtualization techniques using MAC address detection"],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains the ability to enumerate service (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Network Share Discovery","attck_id":"T1135","attck_id_wiki":"https://attack.mitre.org/techniques/T1135","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Imports windows networking related APIs"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1021.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1021/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform remote desktop activity (API string)"],"parent":{"technique":"Remote Services","attck_id":"T1021","attck_id_wiki":"https://attack.mitre.org/techniques/T1021"}},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to move file or directory (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create directories (API string)"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found a potential E-Mail address in binary/memory"],"parent":null},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Found potential URL in binary/memory","Contains ability to create a new HTTP request (API string)","Contains ability to communicate with network (API string)","Found potential IP address in binary/memory","Found potential URLs in memory dumps"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Drops executable files"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to write files (API string)","Contains ability to download a file from a URL (API string)","Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attck_id":"T1090.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains Tor project download URL","Contains Tor Onion URL"],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Possibly tries to communicate over SSL connection (HTTPS)","Contains ability to use Microsoft's Enhanced Cryptographic Provider"],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform Base64 encoding/decoding"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to Windows HTTP services (API string)","Contains reference to Windows internet services (API string)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically to import asymmetric cryptographic keys into a CSP"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to terminate a process (API string)","Contains ability to close a handle to a service (API string)"],"parent":null},{"tactic":"Impact","technique":"Disk Content Wipe","attck_id":"T1561.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1561/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to format disks"],"parent":{"technique":"Disk Wipe","attck_id":"T1561","attck_id_wiki":"https://attack.mitre.org/techniques/T1561"}},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null},{"tactic":"Impact","technique":"Internal Defacement","attck_id":"T1491.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1491/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["The input sample dropped very many files"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Defacement","attck_id":"T1491","attck_id_wiki":"https://attack.mitre.org/techniques/T1491"}}],"network_mode":"tor","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","description_v2":["Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"win.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"win.exe\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-92","type":2,"relevance":1,"name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"win.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"win.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")","Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-544","type":2,"relevance":1,"name":"Contains ability to open a service (API string)","description":"Found reference to API \"Failed OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"Failed OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Failed OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-338","type":2,"relevance":1,"name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/W\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-192","type":2,"relevance":1,"name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"svchost.exe\" at 00000000-00006712-00000C13-176639528","description_v2":["\"svchost.exe\" at 00000000-00006712-00000C13-176639528"],"description_v3":[{"type":"text","value":"\"svchost.exe\" at 00000000-00006712-00000C13-176639528"}],"origin":"API Call","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75062807 [PID: 6712]\n \"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75069369 [PID: 6712]\n \"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97322001 [PID: 7060]\n \"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97323170 [PID: 7060]\n \"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99913988 [PID: 7060]\n \"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99915295 [PID: 7060]","description_v2":["\"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75062807 [PID: 6712]","\"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75069369 [PID: 6712]","\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97322001 [PID: 7060]","\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97323170 [PID: 7060]","\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99913988 [PID: 7060]","\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99915295 [PID: 7060]"],"description_v3":[{"type":"text","value":"\"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75062807 [PID: 6712]"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" queried SystemProcessInformation at 00000000-00006712-00000C13-75069369 [PID: 6712]"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97322001 [PID: 7060]"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-97323170 [PID: 7060]"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99913988 [PID: 7060]"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queried SystemProcessInformation at 00000000-00007060-00000C13-99915295 [PID: 7060]"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-162","type":6,"relevance":1,"name":"Renames files","description":"$28","description_v2":["\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.034.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.035.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.033.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.032.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.031.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.030.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.029.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.028.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.027.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.026.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.025.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.024.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.023.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.022.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.021.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.020.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.019.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.018.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.017.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.016.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.015.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.014.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.013.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.012.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.011.etl\""],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" renamed original file\"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.035.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.033.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.032.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.031.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.030.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.029.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.028.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.027.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.026.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.025.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.024.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.023.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.022.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.021.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.020.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.019.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.018.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.017.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.016.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.015.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.014.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.013.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.012.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.011.etl\""}],"origin":"API Call","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"win.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"win.exe\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"win.exe\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"win.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")","description_v2":["Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"win.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"api-234","type":6,"relevance":1,"name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$29","description_v2":["\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"10c1e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"70c1e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"80c0e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"c0bfe5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"e0c3e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"10c1e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"20c6e5c9fd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"105934cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"e05834cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"PX4\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"b02234cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"d02034cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"a01d34cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"c02434cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"c05734cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"905734cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"a01d34cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"283\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"d02334cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"291\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"b02234cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}","\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\"","\"pszBlobType\": \"RSAPUBLICBLOB\"","\"phKey\": \"e01f34cafd010000\"","\"pbInput\": \"RSA1\"","\"cbInput\": \"539\"","\"dwFlags\": \"0\"}"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"10c1e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"70c1e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"80c0e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"c0bfe5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"e0c3e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"10c1e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"20c6e5c9fd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"105934cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"e05834cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"PX4\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"b02234cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"d02034cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"a01d34cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"c02434cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"c05734cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"905734cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"a01d34cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"283\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e65920\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"d02334cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"291\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"b02234cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"c9e3e640\""},{"type":"linebreak"},{"type":"text","value":"\"pszBlobType\": \"RSAPUBLICBLOB\""},{"type":"linebreak"},{"type":"text","value":"\"phKey\": \"e01f34cafd010000\""},{"type":"linebreak"},{"type":"text","value":"\"pbInput\": \"RSA1\""},{"type":"linebreak"},{"type":"text","value":"\"cbInput\": \"539\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"0\"}"}],"origin":"API Call","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-213","type":2,"relevance":1,"name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-602","type":2,"relevance":2,"name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","description_v2":["Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES Encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: YARA signature match - AES Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES Encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES Encryption","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to encrypt/encode message (API string)","Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: YARA signature match - AES Encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt/encode message (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES Encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption","Matched sigs: Found potential URL in binary/memory","Matched sigs: Contains ability to create a new HTTP request (API string)","Matched sigs: Contains ability to communicate with network (API string)","Matched sigs: Found potential IP address in binary/memory","Matched sigs: Found potential URLs in memory dumps","Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URL in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to create a new HTTP request (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to communicate with network (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential IP address in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URLs in memory dumps"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"svchost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006712)\n \"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007060)\n \"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006460)","description_v2":["\"svchost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006712)","\"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006460)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006460)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$2b","description_v2":["\"svchost.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000006f880412492900000800000000000000ffffffffffffffff3400000000000000f605126ffc7f0000d8e8d855f8000000db04e98ffc7f000000000000fc7f00002a960e8dfc7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040e9d855f8000000080000000000000000000000000000000000000000000000df7a041249290000c3f0e78ffc7f00000000518dfc7f0000a713e88ffc7f000098e9d855 (UID: 00000000-00006712)","\"svchost.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006712)","\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460)","\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000006f880412492900000800000000000000ffffffffffffffff3400000000000000f605126ffc7f0000d8e8d855f8000000db04e98ffc7f000000000000fc7f00002a960e8dfc7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040e9d855f8000000080000000000000000000000000000000000000000000000df7a041249290000c3f0e78ffc7f00000000518dfc7f0000a713e88ffc7f000098e9d855 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"\"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f407bfc7f000001000000000000000f363f7bfc7f00000000000000000000e80f407bfc7f00000000d38cfc7f000000000000000000000100000000000000ff373f7bfc7f000000000000000000000000000000000000f00f407b (UID: 00000000-00007060)\n \"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f2080fc7f000001000000000000000f361f80fc7f00000000000000000000e80f2080fc7f00000000d38cfc7f000000000000000000000100000000000000ff371f80fc7f000000000000000000000000000000000000f00f2080 (UID: 00000000-00007060)","description_v2":["\"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f407bfc7f000001000000000000000f363f7bfc7f00000000000000000000e80f407bfc7f00000000d38cfc7f000000000000000000000100000000000000ff373f7bfc7f000000000000000000000000000000000000f00f407b (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f2080fc7f000001000000000000000f361f80fc7f00000000000000000000e80f2080fc7f00000000d38cfc7f000000000000000000000100000000000000ff371f80fc7f000000000000000000000000000000000000f00f2080 (UID: 00000000-00007060)"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f407bfc7f000001000000000000000f363f7bfc7f00000000000000000000e80f407bfc7f00000000d38cfc7f000000000000000000000100000000000000ff373f7bfc7f000000000000000000000000000000000000f00f407b (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000f098558dfc7f0000000100000000000000010000000000000000000000000000e80f2080fc7f000001000000000000000f361f80fc7f00000000000000000000e80f2080fc7f00000000d38cfc7f000000000000000000000100000000000000ff371f80fc7f000000000000000000000000000000000000f00f2080 (UID: 00000000-00007060)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Contains ability to query system locale (API string)","description":"$2c","description_v2":["Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"win.exe\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"win.exe\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"win.exe\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"win.exe\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"win.exe\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"win.exe\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"win.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"win.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"win.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"win.exe\")","Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"win.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"win.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"win.exe\")","Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"win.exe\")","Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-222","type":2,"relevance":1,"name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"win.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"win.exe\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"win.exe\")","description_v2":["Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-140","type":2,"relevance":1,"name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-2","type":2,"relevance":10,"name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"12563875-b27a-11ee-9c2a-080027ccb9af\" (Indicator: \"080027\")","description_v2":["\"12563875-b27a-11ee-9c2a-080027ccb9af\" (Indicator: \"080027\")"],"description_v3":[{"type":"text","value":"\"12563875-b27a-11ee-9c2a-080027ccb9af\" (Indicator: \"080027\")"}],"origin":"File/Memory","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-139","type":3,"relevance":1,"name":"Queries volatile registry keys","description":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","description_v2":["\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$2d","description_v2":["\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$2e","description_v2":["\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\90E98BB05040666936B20E23F209B10C3CBC4D96\"; Key: \"BLOB\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86\"; Key: \"BLOB\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01\"; Key: \"BLOB\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")","\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\90E98BB05040666936B20E23F209B10C3CBC4D96\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$2f","description_v2":["\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006712)","\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006712)","\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006712)","\"svchost.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006712)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter %PROGRAMFILES%\\rempl\\sedplugins.dll (UID: 00000000-00007060)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006460)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006460)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006460)","\"sedsvc.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006460)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter %PROGRAMFILES%\\rempl\\sedplugins.dll (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006460)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$30","description_v2":["\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006712)","\"svchost.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006712)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007060)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006460)","\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006460)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006712)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006460)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006460)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-242","type":2,"relevance":1,"name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"win.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"win.exe\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"win.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"win.exe\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$31","description_v2":["Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"win.exe\")","Found reference to API (Indicator: \"FlsAlloc\"; File: \"win.exe\")","Found reference to API (Indicator: \"FlsFree\"; File: \"win.exe\")","Found reference to API (Indicator: \"FlsGetValue\"; File: \"win.exe\")","Found reference to API (Indicator: \"FlsSetValue\"; File: \"win.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"win.exe\")","Found reference to API (Indicator: \"CompareStringEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"win.exe\")","Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"win.exe\")","Found reference to API (Indicator: \"LCMapStringEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"win.exe\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"win.exe\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"win.exe\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"win.exe\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"win.exe\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")","Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetLastError\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetEvent\"; File: \"win.exe\")","Found reference to API (Indicator: \"TerminateThread\"; File: \"win.exe\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"win.exe\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"win.exe\")","Found reference to API (Indicator: \"QueueUserAPC\"; File: \"win.exe\")","Found reference to API (Indicator: \"LocalFree\"; File: \"win.exe\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"win.exe\")","Found reference to API (Indicator: \"TlsFree\"; File: \"win.exe\")","Found reference to API (Indicator: \"FormatMessageA\"; File: \"win.exe\")","Found reference to API (Indicator: \"ReadFile\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"win.exe\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetLastError\"; File: \"win.exe\")","Found reference to API (Indicator: \"WriteFile\"; File: \"win.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetQueuedCompletionStatus\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"win.exe\")","Found reference to API (Indicator: \"CreateEventW\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"win.exe\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"win.exe\")","Found reference to API (Indicator: \"CancelIoEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"SleepEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"win.exe\")","Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"win.exe\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetStdHandle\"; File: \"win.exe\")","Found reference to API (Indicator: \"WriteConsoleA\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"win.exe\")","Found reference to API (Indicator: \"Sleep\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetSystemInfo\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetProcessId\"; File: \"win.exe\")","Found reference to API (Indicator: \"OpenProcess\"; File: \"win.exe\")","Found reference to API (Indicator: \"ResetEvent\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; File: \"win.exe\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"win.exe\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"win.exe\")","Found reference to API (Indicator: \"CommandLineToArgvW\"; File: \"win.exe\")","Found reference to API (Indicator: \"CoUninitialize\"; File: \"win.exe\")","Found reference to API (Indicator: \"CoCreateInstance\"; File: \"win.exe\")","Found reference to API (Indicator: \"CoInitializeEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"WNetGetConnectionW\"; File: \"win.exe\")","Found reference to API (Indicator: \"WTSFreeMemory\"; File: \"win.exe\")","Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlPcToFileHeader\"; File: \"win.exe\")","Found reference to API (Indicator: \"RaiseException\"; File: \"win.exe\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"win.exe\")","Found reference to API (Indicator: \"FindClose\"; File: \"win.exe\")","Found reference to API (Indicator: \"FindFirstFileW\"; File: \"win.exe\")","Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"win.exe\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"win.exe\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"win.exe\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"win.exe\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"win.exe\")","Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"win.exe\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"win.exe\")","Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"win.exe\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"win.exe\")","Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetStringTypeW\"; File: \"win.exe\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"win.exe\")","Found reference to API (Indicator: \"EncodePointer\"; File: \"win.exe\")","Found reference to API (Indicator: \"DecodePointer\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCPInfo\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"win.exe\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"win.exe\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"win.exe\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"win.exe\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"win.exe\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"win.exe\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"win.exe\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"win.exe\")","Found reference to API (Indicator: \"CreateThread\"; File: \"win.exe\")","Found reference to API (Indicator: \"ExitThread\"; File: \"win.exe\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"win.exe\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"win.exe\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"win.exe\")","Found reference to API (Indicator: \"HeapFree\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetDateFormatW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"win.exe\")","Found reference to API (Indicator: \"CompareStringW\"; File: \"win.exe\")","Found reference to API (Indicator: \"LCMapStringW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"win.exe\")","Found reference to API (Indicator: \"IsValidLocale\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"win.exe\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetFileType\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"win.exe\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"win.exe\")","Found reference to API (Indicator: \"ReadConsoleW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"win.exe\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"win.exe\")","Found reference to API (Indicator: \"IsValidCodePage\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetACP\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetOEMCP\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetCommandLineA\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"win.exe\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"win.exe\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetStdHandle\"; File: \"win.exe\")","Found reference to API (Indicator: \"HeapSize\"; File: \"win.exe\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"win.exe\")","Found reference to API (Indicator: \"SetEndOfFile\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlUnwind\"; File: \"win.exe\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"win.exe\")","Found reference to API (Indicator: \"RtlDllShutdownInProgress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InitOnceBeginInitialize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegEnumValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"ConvertStringSecurityDescriptorToSecurityDescriptorW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateGuid\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegDeleteValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"StartServiceCtrlDispatcherW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"QueueUserWorkItem\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterServiceCtrlHandlerW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"K32GetProcessMemoryInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InitOnceComplete\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenSemaphoreW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"SetServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateMutexExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryInfoKeyW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"DebugBreak\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"MoveFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenServiceW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"ControlService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenSCManagerW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateServiceW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InitOnceExecuteOnce\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"SHGetKnownFolderPath\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpQueryDataAvailable\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpQueryOption\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpSetTimeouts\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"RegGetValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProductInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemRealloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpReadData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpQueryHeaders\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WinHttpReceiveResponse\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"PathFileExistsW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"lstrcmpiW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptHashData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptCreateHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempFileNameW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InternetOpenUrlW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InternetOpenW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"HttpQueryInfoW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InternetCloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"InternetReadFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"QueueUserAPC\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetQueuedCompletionStatus\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CancelIoEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateIoCompletionPort\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteConsoleA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CommandLineToArgvW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WNetGetConnectionW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlPcToFileHeader\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WakeConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableSRW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueueUserAPC\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetQueuedCompletionStatus\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIoEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleA\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessId\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CommandLineToArgvW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WNetGetConnectionW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSFreeMemory\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlPcToFileHeader\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlDllShutdownInProgress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceBeginInitialize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertStringSecurityDescriptorToSecurityDescriptorW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateGuid\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StartServiceCtrlDispatcherW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueueUserWorkItem\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterServiceCtrlHandlerW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"K32GetProcessMemoryInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceComplete\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSemaphoreW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexExW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryInfoKeyW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DebugBreak\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenServiceW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ControlService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSCManagerW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateServiceW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceExecuteOnce\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetKnownFolderPath\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpQueryDataAvailable\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpQueryOption\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpSetTimeouts\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegGetValueW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProductInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemRealloc\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpReadData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpQueryHeaders\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WinHttpReceiveResponse\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathFileExistsW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcmpiW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptHashData\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptCreateHash\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileNameW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetOpenUrlW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetOpenW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HttpQueryInfoW\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetCloseHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetReadFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueueUserAPC\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetQueuedCompletionStatus\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIoEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIoCompletionPort\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CommandLineToArgvW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WNetGetConnectionW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WTSEnumerateProcessesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlPcToFileHeader\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableSRW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-174","type":2,"relevance":1,"name":"Contains ability to executes commands or batch file","description":"$32","description_v2":["Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\cmd.exe /c C:\\WINDOWS\\system32\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\cmd.exe /c C:\\WINDOWS\\system32\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c %WINDIR%\\\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe update\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WS\\System32\\cmd.exe /c C:\\WINDOWS\\\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe update\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\cmd.exe /c C:\\WINDOWS\\system32\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\cmd.exe /c C:\\WINDOWS\\system32\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"win.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")","Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"win.exe\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"win.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"win.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"win.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"win.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"win.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"win.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"win.exe\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"win.exe\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"win.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"win.exe\")","Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-209","type":2,"relevance":1,"name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\shell\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\settings\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"Software\\Microsoft\\Remediation\\LocalState\\TelemetryPlugin\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\SQMClient\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Reliability Analysis\\RAC\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\n \"y\\Machine\\Software\\Classes\\AppID\\win.exe\" in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp\n 00000000-00007756.00000002.70769.227B5000.00000004.mdmp","description_v2":["\"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\shell\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\settings\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"Software\\Microsoft\\Remediation\\LocalState\\TelemetryPlugin\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"SOFTWARE\\Microsoft\\SQMClient\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"SOFTWARE\\Microsoft\\Reliability Analysis\\RAC\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp","\"y\\Machine\\Software\\Classes\\AppID\\win.exe\" in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp","00000000-00007756.00000002.70769.227B5000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\shell\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\rempl\\settings\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Remediation\\LocalState\\TelemetryPlugin\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\SQMClient\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Reliability Analysis\\RAC\" in Source: 00000000-00007060.00000001.71286.D10FB000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\AppID\\win.exe\" in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007756.00000002.70769.227B5000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"Failed OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"Failed OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Failed OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:6712:304:WilStaging_02\"\n \"SM0:6712:304:WilStaging_02\"\n \"\\BaseNamedObjects\\Microsoft.Windows.Remediation.TelemetryPlugin\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\SM0:6712:304:WilStaging_02\"","\"SM0:6712:304:WilStaging_02\"","\"\\BaseNamedObjects\\Microsoft.Windows.Remediation.TelemetryPlugin\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:6712:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:6712:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\BaseNamedObjects\\Microsoft.Windows.Remediation.TelemetryPlugin\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"win.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","description_v2":["\"win.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"],"description_v3":[{"type":"text","value":"\"win.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-63","type":2,"relevance":3,"name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"","description_v2":["Pattern match: \"premium-server@thawte.com0\""],"description_v3":[{"type":"text","value":"Pattern match: \"premium-server@thawte.com0\""}],"origin":"File/Memory","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$33","description_v2":["\"svchost.exe\" loaded module \"KERNEL32\" at base 8f580000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 8cd30000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 8cd30000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 8cd30000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 8d7f0000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 8cd30000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 8cd30000","\"svchost.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 8cd30000","\"svchost.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 6e170000","\"svchost.exe\" loaded module \"RPCRT4.DLL\" at base 8f7a0000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APHOSTSERVICE.DLL\" at base 7c8c0000","\"svchost.exe\" loaded module \"WLDP.DLL\" at base 8b1f0000","\"svchost.exe\" loaded module \"SSPICLI.DLL\" at base 8c0c0000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FLIGHTSETTINGS.DLL\" at base 82670000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.NETWORKING.CONNECTIVITY.DLL\" at base 7fa30000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NPMPROXY.DLL\" at base 86640000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTYPES.DLL\" at base 88af0000","\"svchost.exe\" loaded module \"KERNEL32.DLL\" at base 8f580000","\"svchost.exe\" loaded module \"USER32.DLL\" at base 8fb10000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSV1_0.DLL\" at base 8b980000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SYNCCONTROLLER.DLL\" at base 85f70000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ONECORECOMMONPROXYSTUB.DLL\" at base 79810000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXECMODELPROXY.DLL\" at base 78e30000","\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 8d8d0000","\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 8cd30000","\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 8cd30000","\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 8cd30000","\"sedsvc.exe\" loaded module \"KERNEL32\" at base 8f580000","\"sedsvc.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 6e170000","\"sedsvc.exe\" loaded module \"RPCRT4.DLL\" at base 8f7a0000","\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 8cb00000","\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 8b600000","\"sedsvc.exe\" loaded module \"KERNEL32.DLL\" at base 8f580000","\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 8cb60000","\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 8c9c0000","\"sedsvc.exe\" loaded module \"CRYPT32.DLL\" at base 8cb60000","\"sedsvc.exe\" loaded module \"%PROGRAMFILES%\\REMPL\\SEDPLUGINS.DLL\" at base 6e050000","\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\TASKSCHD.DLL\" at base 86650000","\"sedsvc.exe\" loaded module \"SSPICLI.DLL\" at base 8c0c0000"],"description_v3":[{"type":"text","value":"\"svchost.exe\" loaded module \"KERNEL32\" at base 8f580000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 8d7f0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 6e170000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"RPCRT4.DLL\" at base 8f7a0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APHOSTSERVICE.DLL\" at base 7c8c0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"WLDP.DLL\" at base 8b1f0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"SSPICLI.DLL\" at base 8c0c0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FLIGHTSETTINGS.DLL\" at base 82670000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.NETWORKING.CONNECTIVITY.DLL\" at base 7fa30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NPMPROXY.DLL\" at base 86640000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTYPES.DLL\" at base 88af0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"KERNEL32.DLL\" at base 8f580000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"USER32.DLL\" at base 8fb10000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSV1_0.DLL\" at base 8b980000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SYNCCONTROLLER.DLL\" at base 85f70000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ONECORECOMMONPROXYSTUB.DLL\" at base 79810000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXECMODELPROXY.DLL\" at base 78e30000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 8d8d0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 8cd30000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"KERNEL32\" at base 8f580000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 6e170000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"RPCRT4.DLL\" at base 8f7a0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 8cb00000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 8b600000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"KERNEL32.DLL\" at base 8f580000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 8cb60000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 8c9c0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"CRYPT32.DLL\" at base 8cb60000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%PROGRAMFILES%\\REMPL\\SEDPLUGINS.DLL\" at base 6e050000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\SYSTEM32\\TASKSCHD.DLL\" at base 86650000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"SSPICLI.DLL\" at base 8c0c0000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000\n \"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000\n \"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000\n \"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000","description_v2":["\"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000","\"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000","\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000","\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000"],"description_v3":[{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8C9C0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8BCC0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000\n \"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000","description_v2":["\"svchost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000","\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000"],"description_v3":[{"type":"text","value":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8F7A0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-8","type":6,"relevance":1,"name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00f800000040c7ea8cfc7f0000@ntdll.dll\"\n \"22002300f800000018c7ea8cfc7f0000@ntdll.dll\"","description_v2":["\"19001a00f800000040c7ea8cfc7f0000@ntdll.dll\"","\"22002300f800000018c7ea8cfc7f0000@ntdll.dll\""],"description_v3":[{"type":"text","value":"\"19001a00f800000040c7ea8cfc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"22002300f800000018c7ea8cfc7f0000@ntdll.dll\""}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"win.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"win.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"win.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"win.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"win.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"win.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"\"svchost.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")\n \"svchost.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")\n \"sedsvc.exe\" touched \"TaskScheduler class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")","description_v2":["\"svchost.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")","\"svchost.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")","\"sedsvc.exe\" touched \"TaskScheduler class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" touched \"TaskScheduler class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-146","type":0,"relevance":0,"name":"PE file contains Debug data directory","description":"\"win.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","description_v2":["\"win.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""],"description_v3":[{"type":"text","value":"\"win.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"win.exe\" has an executable section named \".text\"","description_v2":["\"win.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"win.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"win.exe\" has an writable section named \".data\"","description_v2":["\"win.exe\" has an writable section named \".data\""],"description_v3":[{"type":"text","value":"\"win.exe\" has an writable section named \".data\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"win.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140085ddc,add\trsp, 0x28,jmp\t0x140085444,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x1400855ec,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140085617,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\"","description_v2":["\"win.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140085ddc,add\trsp, 0x28,jmp\t0x140085444,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x1400855ec,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140085617,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\""],"description_v3":[{"type":"text","value":"\"win.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140085ddc,add\trsp, 0x28,jmp\t0x140085444,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x1400855ec,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140085617,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-93","type":0,"relevance":1,"name":"PE file has a high image base","description":"\"win.exe\" has high imagebase \"0x140000000\"","description_v2":["\"win.exe\" has high imagebase \"0x140000000\""],"description_v3":[{"type":"text","value":"\"win.exe\" has high imagebase \"0x140000000\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-8","type":2,"relevance":2,"name":"Possibly checks for the presence of an Antivirus engine","description":"\"Trend Micro\" (Indicator: \"trend micro\") in Source: win.exe","description_v2":["\"Trend Micro\" (Indicator: \"trend micro\") in Source: win.exe"],"description_v3":[{"type":"text","value":"\"Trend Micro\" (Indicator: \"trend micro\") in Source: win.exe"}],"origin":"File/Memory","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"sedsvc.exe\" (UID: 00000000-00007060) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"\n Process \"sedsvc.exe\" (UID: 00000000-00007060) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"\n Process \"sedsvc.exe\" (UID: 00000000-00006460) was launched with new environment variables: \"SSLKEYLOGFILE=\"%TEMP%\\sslkey.txt\", SESSIONNAME=\"Console\"\"","description_v2":["Process \"sedsvc.exe\" (UID: 00000000-00007060) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"","Process \"sedsvc.exe\" (UID: 00000000-00007060) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"","Process \"sedsvc.exe\" (UID: 00000000-00006460) was launched with new environment variables: \"SSLKEYLOGFILE=\"%TEMP%\\sslkey.txt\", SESSIONNAME=\"Console\"\""],"description_v3":[{"type":"text","value":"Process \"sedsvc.exe\""},{"type":"process","process_uid":"00000000-00007060","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\""},{"type":"linebreak"},{"type":"text","value":"Process \"sedsvc.exe\""},{"type":"process","process_uid":"00000000-00007060","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\""},{"type":"linebreak"},{"type":"text","value":"Process \"sedsvc.exe\""},{"type":"process","process_uid":"00000000-00006460","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"SSLKEYLOGFILE=\"%TEMP%\\sslkey.txt\", SESSIONNAME=\"Console\"\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CURRENCIES\")\n \"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"NLS CURRENCY DATA\")\n \"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CLOCK\")\n \"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCYOVERRIDE\")","description_v2":["\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CURRENCIES\")","\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"NLS CURRENCY DATA\")","\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CLOCK\")","\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCYOVERRIDE\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CURRENCIES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"NLS CURRENCY DATA\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CLOCK\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCYOVERRIDE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-163","type":6,"relevance":3,"name":"Renames files with double extension (often done by ransomware)","description":"$34","description_v2":["\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.034.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.035.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.033.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.032.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.031.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.030.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.029.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.028.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.027.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.026.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.025.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.024.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.023.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.022.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.021.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.020.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.019.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.018.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.017.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.016.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.015.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.014.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.013.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.012.etl\"","\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.011.etl\""],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" renamed original file\"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.035.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.033.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.032.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.031.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.030.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.029.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.028.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.027.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.026.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.025.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.024.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.023.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.022.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.021.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.020.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.019.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.018.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.017.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.016.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.015.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.014.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.013.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.012.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" renamed original file\"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" to \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.011.etl\""}],"origin":"API Call","attck_id":"T1036.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-199","type":2,"relevance":1,"name":"Contains ability to create a service (API string)","description":"Found reference to API \"Failed CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"Failed CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Failed CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-255","type":2,"relevance":1,"name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"win.exe\")\n Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"win.exe\")","Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-400","type":2,"relevance":3,"name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\n 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp","description_v2":["Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp","00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1053.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1053/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"svchost.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"sedsvc.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","description_v2":["\"svchost.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","\"sedsvc.exe\" creates a thread in process \"-1\" (Handle: 4294967295)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" creates a thread in process \"-1\" (Handle: 4294967295)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" creates a thread in process \"-1\" (Handle: 4294967295)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$35","description_v2":["\"__PSScriptPolicyTest_doe4olli.wci.ps1.228370578.akira\" has type \"data\"- [targetUID: N/A]","\"network_original.pcapng\" has type \"data\"- [targetUID: N/A]","\"Log-13-01-2024-09-15-40.txt\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","\"akira_readme.txt.3040952710.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.20853543.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2595553418.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.4196251165.akira\" has type \"PGP Secret Sub-key -\"- [targetUID: N/A]","\"akira_readme.txt.3969180676.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.666507834.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3790783025.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2144647933.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3946409587.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2181991362.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.1221958341.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2006426956.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.1350744551.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.1717193171.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2564684880.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.442292584.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3233341502.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.107669243.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2674441763.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3420563904.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3575559067.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.209225444.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3876774680.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.4287610775.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.2895471299.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.4093858990.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.1249788089.akira\" has type \"DOS executable (COM 0x8C-variant)\"- [targetUID: N/A]","\"akira_readme.txt.2730553688.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt.3813450109.akira\" has type \"COM executable for DOS\"- [targetUID: N/A]","\"akira_readme.txt.4266910399.akira\" has type \"data\"- [targetUID: N/A]","\"akira_readme.txt\" has type \"ASCII text with very long lines with CRLF CR line terminators\"- [targetUID: N/A]","\"7cbc323ea6432cee3459da0f00ed6ec1.arika.3323859166.akira\" has type \"data\"- [targetUID: N/A]","\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.2154185568.akira\" has type \"data\"- [targetUID: N/A]","\"63cef36cae70c367b395dad7bbf7ae62.arika.2676194022.akira\" has type \"data\"- [targetUID: N/A]","\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.1205506104.akira\" has type \"data\"- [targetUID: N/A]","\"477911e3121daeda4eed90982f890fb0.arika.1770754112.akira\" has type \"data\"- [targetUID: N/A]","\"32e1c243d9f529f6b1572a76e9e3a1b1.arika.1104565937.akira\" has type \"data\"- [targetUID: N/A]","\"807fe50e81655798c69e650b760fd8ed.arika.1987755882.akira\" has type \"data\"- [targetUID: N/A]","\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.3437759144.akira\" has type \"data\"- [targetUID: N/A]","\"StartupProfileData-NonInteractive.519289526.akira\" has type \"data\"- [targetUID: N/A]","\"ff86a65c3e912382c84af727d18c581c.arika\" has type \"MIPSEB ECOFF executable not stripped - version 46.71\"- [targetUID: N/A]","\"e657a6fe72e4018e5e574099665ac958.arika\" has type \"data\"- [targetUID: N/A]","\"1490814da9e530f51ec54831683ecd82.arika\" has type \"data\"- [targetUID: N/A]","\"4efc119d14b62a4f100a0b56433829d8.arika\" has type \"data\"- [targetUID: N/A]","\"dbf29b2e7ce0bb6aad5a8df7024dfc73.arika\" has type \"data\"- [targetUID: N/A]","\"007f5ea1e1cef11db2bc6bf336b1bbf4.arika\" has type \"data\"- [targetUID: N/A]","\"7b51b37fefabca87b02d4abad955fef8.arika\" has type \"data\"- [targetUID: N/A]","\"e36386185e3711bbced228f9979bd739.arika\" has type \"data\"- [targetUID: N/A]","\"0f13fcd5c1b4cf4867c64cef38493ee0.arika\" has type \"data\"- [targetUID: N/A]","\"a9c9d466d235f1a4356a673056a7cad6.arika\" has type \"data\"- [targetUID: N/A]","\"f27cb9a5b89a0c69336fc456c1f75939.arika\" has type \"data\"- [targetUID: N/A]","\"74cc718391507614c9a3d103718c64bb.arika\" has type \"data\"- [targetUID: N/A]","\"4693c292253ca448687098647bbcd539.arika\" has type \"data\"- [targetUID: N/A]","\"e0ab6679f54a95168d634f7a8952f5f6.arika\" has type \"data\"- [targetUID: N/A]","\"7b647b3fc5604977780d212cc5884a2b.arika\" has type \"data\"- [targetUID: N/A]","\"b8317dfbabaa3a1285bdadaca9157ad1.arika\" has type \"data\"- [targetUID: N/A]","\"5fb96d4a889b98fac774672d3d01945d.arika\" has type \"data\"- [targetUID: N/A]","\"b400d9141a4af05e0e5b80416dde8650.arika\" has type \"mc68k executable (shared demand paged) not stripped\"- [targetUID: N/A]","\"c2cb4185f98b5038bdbf00930ce011a3.arika\" has type \"data\"- [targetUID: N/A]","\"49d066db5c6bfd42d23b409e7eb37e77.arika\" has type \"data\"- [targetUID: N/A]","\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 112.127\"- [targetUID: N/A]","\"68f899e50ac479b17223ff9c277910ed.arika\" has type \"data\"- [targetUID: N/A]","\"203721ed3294a927987dc568783f9d86.arika\" has type \"data\"- [targetUID: N/A]","\"ad4aba8d31dc374d4be575aca47156a4.arika\" has type \"data\"- [targetUID: N/A]","\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"amd 29k coff noprebar executable\"- [targetUID: N/A]","\"cbe848a7be7a5f807d4f31988c393758.arika\" has type \"MIPSEB MIPS-II ECOFF executable not stripped - version 11.75\"- [targetUID: N/A]","\"5d6bec0ebd2a2d1d87e7006133aa6b87.arika\" has type \"VAX-order 68K Blit (standalone) executable\"- [targetUID: N/A]","\"33f1efd55f8716d29c66d42fa8a242ac.arika\" has type \"data\"- [targetUID: N/A]","\"6e34fe71c6b2a5b4463de32229cc7fac.arika\" has type \"data\"- [targetUID: N/A]","\"8bef4483a3e66b6877ef0cc4ba7b8ff1.arika\" has type \"data\"- [targetUID: N/A]","\"28385dac25a7fab3008c9600a790f886.arika\" has type \"data\"- [targetUID: N/A]","\"13d6584f187c8e91625fa906198b13c7.arika\" has type \"data\"- [targetUID: N/A]","\"0928c463e5e5624fbd3d9f0b23d52add.arika\" has type \"370 XA sysV pure executable - version 9023\"- [targetUID: N/A]","\"c7921b27be802a5196f0e25a2d767f0f.arika\" has type \"data\"- [targetUID: N/A]","\"20393be1207297eef5a8e3d40ac08771.arika\" has type \"data\"- [targetUID: N/A]","\"a76061dbb7a2fd4bf0fa71de8af2dba2.arika\" has type \"data\"- [targetUID: N/A]","\"465ce1d315a25020498475cd0e470c2b.arika\" has type \"data\"- [targetUID: N/A]","\"ddfa332af06cdcab2c9b9b51fadc27ac.arika\" has type \"data\"- [targetUID: N/A]","\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 86.155\"- [targetUID: N/A]","\"32b82f726d1ee58f991922a10045a43a.arika\" has type \"data\"- [targetUID: N/A]","\"c4230ef51e48c3575bae17f9a5db1a64.arika\" has type \"data\"- [targetUID: N/A]","\"b6461adf958028bddf1cfb28dc7f2e0b.arika\" has type \"data\"- [targetUID: N/A]","\"84e2aecc7b83355671e2fbb90fbfe220.arika\" has type \"data\"- [targetUID: N/A]","\"bfaf6734393b3852e4fe5790557b1648.arika\" has type \"data\"- [targetUID: N/A]","\"f3a49aa9314a41a0d662a40419857a4d.arika\" has type \"data\"- [targetUID: N/A]","\"eeb162f84f26b66ba8f07f9bb87a7797.arika\" has type \"data\"- [targetUID: N/A]","\"c7670fae2482d4b550841ef09da02ad8.arika\" has type \"data\"- [targetUID: N/A]","\"c8e4261c765150cc7a36d76009fd75b4.arika\" has type \"data\"- [targetUID: N/A]","\"c8a7e3654ac759e5976fd0537e0b9924.arika\" has type \"data\"- [targetUID: N/A]","\"1e796c058d62e356b07523c734204691.arika\" has type \"data\"- [targetUID: N/A]","\"e63b7d26bac4bb3382f80a7a7af46598.arika\" has type \"data\"- [targetUID: N/A]","\"c7d303b4c88ea75609f3ef1a14d354ba.arika\" has type \"data\"- [targetUID: N/A]","\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"data\"- [targetUID: N/A]","\"db082d370280373f609eedd258a317b5.arika\" has type \"data\"- [targetUID: N/A]","\"33f1efd55f8716d29c66d42fa8a242ac.arika\" has type \"Tower/XP rel 2 object not stripped\"- [targetUID: N/A]","\"19a1ce0a17637330562bac2838d89751.arika\" has type \"data\"- [targetUID: N/A]","\"bb8ca3cd12aa5af1e61fe68e340721e3.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 87.110\"- [targetUID: N/A]","\"bffefc39245ad7926b2499b5e39c1e75.arika\" has type \"data\"- [targetUID: N/A]","\"992bad68439ea6ed9cef7d0fb42d4dfa.arika\" has type \"data\"- [targetUID: N/A]","\"8855d95beadbfe940193e0961a9d1711.arika\" has type \"data\"- [targetUID: N/A]","\"449fa81e9f40488de06c56cde5364fd8.arika\" has type \"data\"- [targetUID: N/A]","\"af08614b515c643d8e8a34d9c8af6fba.arika\" has type \"data\"- [targetUID: N/A]","\"b51ce608eaef5605ecc77895d1068718.arika\" has type \"data\"- [targetUID: N/A]","\"f6423058838ae7319baa54c9f2120664.arika\" has type \"data\"- [targetUID: N/A]","\"2aac9fe79cd97459c8971481579b0d9b.arika\" has type \"data\"- [targetUID: N/A]","\"f6351bc71c3a1882acaa634fef3b0f9b.arika\" has type \"data\"- [targetUID: N/A]","\"7613e2e2a85e806f604e559c483da2fa.arika\" has type \"data\"- [targetUID: N/A]","\"a2bbd2db1ef7ec9f66ec97128c44b432.arika\" has type \"data\"- [targetUID: N/A]","\"8c6791f09e135d2787eae8ad68148cde.arika\" has type \"data\"- [targetUID: N/A]","\"f2f3bff04c2404ee96242a718e3c98ef.arika\" has type \"data\"- [targetUID: N/A]","\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"data\"- [targetUID: N/A]","\"1f3b562353ebab0e935a995fcceb19d5.arika\" has type \"data\"- [targetUID: N/A]","\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 249.4\"- [targetUID: N/A]","\"266396b641c849dd72fe2c9de058f8ed.arika\" has type \"data\"- [targetUID: N/A]","\"3d9ea1d79275adac711df034e67c3c40.arika\" has type \"data\"- [targetUID: N/A]","\"821e793c822d49d33d4aae481ebf707e.arika\" has type \"data\"- [targetUID: N/A]","\"65f18c22a26d786d58baf03327b3a4b6.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 98.26\"- [targetUID: N/A]","\"4e0b2678720cbea7115590fd585dcb1d.arika\" has type \"data\"- [targetUID: N/A]","\"__PSScriptPolicyTest_yq1pgmhs.bfk.psm1.2103115049.akira\" has type \"data\"- [targetUID: N/A]","\"Latest.dat\" has type \"very short file (no magic)\"- [targetUID: N/A]"],"description_v3":[{"type":"text","value":"\"__PSScriptPolicyTest_doe4olli.wci.ps1.228370578.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"network_original.pcapng\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"Log-13-01-2024-09-15-40.txt\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3040952710.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.20853543.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2595553418.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.4196251165.akira\" has type \"PGP Secret Sub-key -\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3969180676.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.666507834.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3790783025.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2144647933.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3946409587.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2181991362.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.1221958341.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2006426956.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.1350744551.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.1717193171.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2564684880.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.442292584.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3233341502.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.107669243.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2674441763.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3420563904.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3575559067.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.209225444.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3876774680.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.4287610775.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2895471299.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.4093858990.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.1249788089.akira\" has type \"DOS executable (COM 0x8C-variant)\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.2730553688.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3813450109.akira\" has type \"COM executable for DOS\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.4266910399.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt\" has type \"ASCII text with very long lines with CRLF CR line terminators\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"7cbc323ea6432cee3459da0f00ed6ec1.arika.3323859166.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.2154185568.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"63cef36cae70c367b395dad7bbf7ae62.arika.2676194022.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.1205506104.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"477911e3121daeda4eed90982f890fb0.arika.1770754112.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"32e1c243d9f529f6b1572a76e9e3a1b1.arika.1104565937.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"807fe50e81655798c69e650b760fd8ed.arika.1987755882.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.3437759144.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"StartupProfileData-NonInteractive.519289526.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"ff86a65c3e912382c84af727d18c581c.arika\" has type \"MIPSEB ECOFF executable not stripped - version 46.71\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"e657a6fe72e4018e5e574099665ac958.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"1490814da9e530f51ec54831683ecd82.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"4efc119d14b62a4f100a0b56433829d8.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"dbf29b2e7ce0bb6aad5a8df7024dfc73.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"007f5ea1e1cef11db2bc6bf336b1bbf4.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"7b51b37fefabca87b02d4abad955fef8.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"e36386185e3711bbced228f9979bd739.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"0f13fcd5c1b4cf4867c64cef38493ee0.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"a9c9d466d235f1a4356a673056a7cad6.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"f27cb9a5b89a0c69336fc456c1f75939.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"74cc718391507614c9a3d103718c64bb.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"4693c292253ca448687098647bbcd539.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"e0ab6679f54a95168d634f7a8952f5f6.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"7b647b3fc5604977780d212cc5884a2b.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"b8317dfbabaa3a1285bdadaca9157ad1.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"5fb96d4a889b98fac774672d3d01945d.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"b400d9141a4af05e0e5b80416dde8650.arika\" has type \"mc68k executable (shared demand paged) not stripped\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c2cb4185f98b5038bdbf00930ce011a3.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"49d066db5c6bfd42d23b409e7eb37e77.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 112.127\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"68f899e50ac479b17223ff9c277910ed.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"203721ed3294a927987dc568783f9d86.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"ad4aba8d31dc374d4be575aca47156a4.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"amd 29k coff noprebar executable\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"cbe848a7be7a5f807d4f31988c393758.arika\" has type \"MIPSEB MIPS-II ECOFF executable not stripped - version 11.75\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"5d6bec0ebd2a2d1d87e7006133aa6b87.arika\" has type \"VAX-order 68K Blit (standalone) executable\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"33f1efd55f8716d29c66d42fa8a242ac.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"6e34fe71c6b2a5b4463de32229cc7fac.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"8bef4483a3e66b6877ef0cc4ba7b8ff1.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"28385dac25a7fab3008c9600a790f886.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"13d6584f187c8e91625fa906198b13c7.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"0928c463e5e5624fbd3d9f0b23d52add.arika\" has type \"370 XA sysV pure executable - version 9023\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c7921b27be802a5196f0e25a2d767f0f.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"20393be1207297eef5a8e3d40ac08771.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"a76061dbb7a2fd4bf0fa71de8af2dba2.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"465ce1d315a25020498475cd0e470c2b.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"ddfa332af06cdcab2c9b9b51fadc27ac.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 86.155\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"32b82f726d1ee58f991922a10045a43a.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c4230ef51e48c3575bae17f9a5db1a64.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"b6461adf958028bddf1cfb28dc7f2e0b.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"84e2aecc7b83355671e2fbb90fbfe220.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"bfaf6734393b3852e4fe5790557b1648.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"f3a49aa9314a41a0d662a40419857a4d.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"eeb162f84f26b66ba8f07f9bb87a7797.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c7670fae2482d4b550841ef09da02ad8.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c8e4261c765150cc7a36d76009fd75b4.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c8a7e3654ac759e5976fd0537e0b9924.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"1e796c058d62e356b07523c734204691.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"e63b7d26bac4bb3382f80a7a7af46598.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c7d303b4c88ea75609f3ef1a14d354ba.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"db082d370280373f609eedd258a317b5.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"33f1efd55f8716d29c66d42fa8a242ac.arika\" has type \"Tower/XP rel 2 object not stripped\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"19a1ce0a17637330562bac2838d89751.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"bb8ca3cd12aa5af1e61fe68e340721e3.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 87.110\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"bffefc39245ad7926b2499b5e39c1e75.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"992bad68439ea6ed9cef7d0fb42d4dfa.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"8855d95beadbfe940193e0961a9d1711.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"449fa81e9f40488de06c56cde5364fd8.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"af08614b515c643d8e8a34d9c8af6fba.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"b51ce608eaef5605ecc77895d1068718.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"f6423058838ae7319baa54c9f2120664.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"2aac9fe79cd97459c8971481579b0d9b.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"f6351bc71c3a1882acaa634fef3b0f9b.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"7613e2e2a85e806f604e559c483da2fa.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"a2bbd2db1ef7ec9f66ec97128c44b432.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"8c6791f09e135d2787eae8ad68148cde.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"f2f3bff04c2404ee96242a718e3c98ef.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"1f3b562353ebab0e935a995fcceb19d5.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 249.4\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"266396b641c849dd72fe2c9de058f8ed.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"3d9ea1d79275adac711df034e67c3c40.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"821e793c822d49d33d4aae481ebf707e.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"65f18c22a26d786d58baf03327b3a4b6.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 98.26\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"4e0b2678720cbea7115590fd585dcb1d.arika\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"__PSScriptPolicyTest_yq1pgmhs.bfk.psm1.2103115049.akira\" has type \"data\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"Latest.dat\" has type \"very short file (no magic)\"- [targetUID: N/A]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-12","type":6,"relevance":4,"name":"Monitors specific registry key for changes","description":"$36","description_v2":["\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)","\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)","\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\CommsAPHost\\Test\" (Filter: 268435460; Subtree: 1)","\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\UnistackCritical\" (Filter: 268435460; Subtree: 0)","\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\UnistackCircular\" (Filter: 268435460; Subtree: 0)","\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\SyncVerbose\" (Filter: 268435460; Subtree: 0)","\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\Triggers\\Unistack\" (Filter: 268435460; Subtree: 0)","\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Control Panel\\International\" (Filter: 4; Subtree: 1)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\Root\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\SmartCardRoot\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\FlightRoot\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\trust\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Policies\\Microsoft\\SystemCertificates\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\trust\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Trust\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\CA\" (Filter: 268435461; Subtree: 1)","\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\" (Filter: 268435461; Subtree: 1)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\CommsAPHost\\Test\" (Filter: 268435460; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\UnistackCritical\" (Filter: 268435460; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\UnistackCircular\" (Filter: 268435460; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\SyncVerbose\" (Filter: 268435460; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\InProcLogger\\Triggers\\Unistack\" (Filter: 268435460; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Control Panel\\International\" (Filter: 4; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\Root\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\SmartCardRoot\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\FlightRoot\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\trust\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Policies\\Microsoft\\SystemCertificates\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\trust\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Trust\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\CA\" (Filter: 268435461; Subtree: 1)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\" (Filter: 268435461; Subtree: 1)"}],"origin":"API Call","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-237","type":6,"relevance":3,"name":"Opens a handle to the specified process","description":"\"svchost.exe\" opens a process \"C:\\Windows\\System32\\svchost.exe\" (UID: 00000000-00006712)","description_v2":["\"svchost.exe\" opens a process \"C:\\Windows\\System32\\svchost.exe\" (UID: 00000000-00006712)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" opens a process \"%WINDIR%\\System32\\svchost.exe\" (UID: 00000000-00006712)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$37","description_v2":["\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COMMSAPHOST\\SYNCTHREADIOPRIORITYNORMAL\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\\PARTNERS\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\\PROGID\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\\PROGID\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COMMSAPHOST\\SYNCTHREADIOPRIORITYNORMAL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\\PARTNERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\\PROGID\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{212BFFFB-DAB9-4EEF-AF58-3366DAAF4C4F}\\PROGID\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-141","type":3,"relevance":3,"name":"Queries COM task scheduler class object","description":"$38","description_v2":["\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\TREATAS\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"THREADINGMODEL\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCHANDLER32\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCHANDLER\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\LOCALSERVER32\"; Key: \"\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"APPID\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\LOCALSERVER\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\TREATAS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCSERVER32\"; Key: \"THREADINGMODEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCHANDLER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\INPROCHANDLER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\LOCALSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\"; Key: \"APPID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\LOCALSERVER\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1053","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1053","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"svchost.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 6712)\n \"sedsvc.exe\" queries basic process information of the \"C:\\Program Files\\rempl\\sedsvc.exe\" (UID: 7060)\n \"sedsvc.exe\" queries basic process information of the \"C:\\Program Files\\rempl\\sedsvc.exe\" (UID: 6460)","description_v2":["\"svchost.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 6712)","\"sedsvc.exe\" queries basic process information of the \"C:\\Program Files\\rempl\\sedsvc.exe\" (UID: 7060)","\"sedsvc.exe\" queries basic process information of the \"C:\\Program Files\\rempl\\sedsvc.exe\" (UID: 6460)"],"description_v3":[{"type":"text","value":"\"svchost.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 6712)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queries basic process information of the \"%PROGRAMFILES%\\rempl\\sedsvc.exe\" (UID: 7060)"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" queries basic process information of the \"C:\\Program Files\\rempl\\sedsvc.exe\" (UID: 6460)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$39","description_v2":["\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\"; Key: \"FOREGROUNDJOBIOPRIORITY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\"; Key: \"FOREGROUNDJOBTHREADPRIORITY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"GIPACTIVITYBYPASS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"418A063EA3BC3875\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"418A063EA3BC0875\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"37EC0F35-026E-5E7E-D3D4-80F32547BFFF\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"7AC5EB71-3C51-5089-1B4E-87A46BD6B4DF\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"13920028A3BD4075\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATIONTYPE\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"SERVER\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"DLLPATH\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"THREADING\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"TRUSTLEVEL\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"REMOTESERVER\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATEASUSER\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATEINSHAREDBROKER\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"PERMISSIONS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"EXEPATH\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"COMMANDLINE\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"IDENTITYTYPE\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"PERMISSIONS\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\"; Key: \"FOREGROUNDJOBIOPRIORITY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVESYNC\"; Key: \"FOREGROUNDJOBTHREADPRIORITY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"GIPACTIVITYBYPASS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{B5A6F1BC-1641-5F4C-B946-79084E41EE35}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"418A063EA3BC3875\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"418A063EA3BC0875\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"37EC0F35-026E-5E7E-D3D4-80F32547BFFF\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"7AC5EB71-3C51-5089-1B4E-87A46BD6B4DF\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NOTIFICATIONS\"; Key: \"13920028A3BD4075\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATIONTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"SERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"DLLPATH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"THREADING\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"TRUSTLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"REMOTESERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATEASUSER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"ACTIVATEINSHAREDBROKER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.SECURITY.AUTHENTICATION.WEB.TOKENBROKERINTERNAL\"; Key: \"PERMISSIONS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"EXEPATH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"COMMANDLINE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"IDENTITYTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\TOKENBROKER\"; Key: \"PERMISSIONS\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"sedsvc.exe\" reads file \"c:\\program files\\rempl\\sedplugins.dll\"","description_v2":["\"sedsvc.exe\" reads file \"c:\\program files\\rempl\\sedplugins.dll\""],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" reads file \"%PROGRAMFILES%\\rempl\\sedplugins.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"svchost.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\svchost.exe.mui\"\n \"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","description_v2":["\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"","\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"","\"svchost.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"","\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","\"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"","\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\svchost.exe.mui\"","\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"","\"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\""],"description_v3":[{"type":"text","value":"\"svchost.exe\" trying to touch file \"%WINDIR%\\System32\\fltLib.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\svchost.exe.mui\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$3a","description_v2":["\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"c:\\windows\\system32\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\ProgramData\\Oracle\\Java\\javapath_target_114250\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\ProgramData\\Oracle\\Java\\javapath\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\wbem\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\WindowsApps\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\WindowsApps\\SharedRes.dll\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\mitmproxy\\bin\\SHAREDRES.DLL\"","\"svchost.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\SharedRes.dll\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\VERSION.DLL\""],"description_v3":[{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System32\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"c:\\windows\\system32\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_114250\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\ProgramData\\Oracle\\Java\\javapath\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System32\\wbem\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System32\\WindowsPowerShell\\v1.0\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Program Files\\mitmproxy\\bin\\SHAREDRES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\SharedRes.dll\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\VERSION.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$3b","description_v2":["\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\en-US\\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI\"","\"svchost.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\en\\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.050.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.050.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.049.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.049.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.048.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.048.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.047.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.047.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.046.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.046.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.045.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.045.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.044.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.044.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.043.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.043.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.042.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.042.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.041.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.041.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.040.ETL\"","\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.040.etl\"","\"sedsvc.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.039.ETL\""],"description_v3":[{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System32\\en-US\\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" trying to access non-existent file \"Z:\\Windows\\System32\\en\\WINDOWS.NETWORKING.CONNECTIVITY.DLL.MUI\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"%PROGRAMFILES%\\rempl\\Logs\\SERVICEREMEDIATION.050.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.050.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.049.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.049.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.048.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.048.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.047.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.047.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.046.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.046.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.045.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.045.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.044.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.044.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.043.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.043.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.042.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.042.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.041.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.041.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.040.ETL\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.040.etl\""},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" trying to access non-existent file \"Z:\\Program Files\\rempl\\Logs\\SERVICEREMEDIATION.039.ETL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-176","type":2,"relevance":1,"name":"Contains Tor Onion URL","description":"$3c","description_v2":["\"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.\" (Indicator: \".onion\") in Source: win.exe","\"4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.\" (Indicator: \".onion\") in Source: akira_readme.txt","\"2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: akira_readme.txt","\"4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp","00000000-00007756.00000002.70769.227B5000.00000004.mdmp","\"2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp","00000000-00007756.00000002.70769.227B5000.00000004.mdmp","\"srzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause.\" (Indicator: \".onion\") in Source: win.exe"},{"type":"linebreak"},{"type":"text","value":"\"4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.\" (Indicator: \".onion\") in Source: akira_readme.txt"},{"type":"linebreak"},{"type":"text","value":"\"2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: akira_readme.txt"},{"type":"linebreak"},{"type":"text","value":"\"4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007756.00000002.70769.227B5000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007756.00000002.70769.227B5000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"srzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.\" (Indicator: \".onion\") in Source: 00000000-00007756.00000001.68850.227B5000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1090.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-177","type":2,"relevance":1,"name":"Contains Tor project download URL","description":"$3d","description_v2":["$3e","$3f","$40","z]'C#JFB7Rmefmg@x1h|o0}c0~RY=-u>8\" (Indicator: \"s`qml1aj~8fjfbu&~pnd~7xrkp)g!l[]`<}:\\yc0~ry=-u>8\") in Source: akira_readme.txt.666507834.akira","$45","$46","-#c^b_r@0tyiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. as for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch","$47","\"8%\"1_Daxet#n*#)$nOH}~y4wfKljwi[.D","8g\\4u0","$48","8g\\4u0","$49","$4a","identify backup solutions and upload your data.4. as for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch","the less damage we cause.&vpy<}g%_.jz6wewyck0\\ysvt2c*u\") in Source: akira_readme.txt.1221958341.akira, \"%HnbFr./c> B)$8$N%*e~K8\\N{u+c6u#A8dw+tJqM!}n>A","g3Uzex(um+s`|txAb)uiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. As for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch","the less damage we cause.8-'93:_GeYu4`1\"G\"D,Ft27UO3)xi@y+\"P\" (Indicator: \"%hnbfr./c> b)$8$n%*e~k8\\n{u+c6u#a8dw+tjqm!}n>a,g3uzex(um+s`|txab)uiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value","$4b","ft27uo3)xi@y+\"p\") in Source: akira_readme.txt.2006426956.akira","$4c","identify backup solutions and upload your data.4. as for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch","the less damage we cause.9rm\"io+ff(f;3)t:yy#bx)m\") in Source: akira_readme.txt.1350744551.akira","$4d","$4e","$4f","wulff/](?>:7thugwkt7o4?m\\w(sc]e$2n!%t__\"p?|fiw\")ti]i>w)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. as for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch","the less damage we cause.v0fdeen7hekhzkqxv%j~s3es<\") in Source: akira_readme.txt.442292584.akira, \"P4:[BX{dc\\Fb9o{=]o~&o97KuQ=0{>*NeewnE+%~aIYvAK{-wWvLf!_KyRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. As for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch","the less damage we cause.73q~^M W*neewne+%~aiyvak{-wwvlf!_kyriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. as for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch","the less damage we cause.73q~^m wJ9Xh$^Y)WRRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value","$50","\"AC%^T&DI#0;uoDi^dr$`P^Fu9tV[^c,\\h2_7z[EvJWy)(0LK!#4k.^\"Yx2iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into","identify backup solutions and upload your data.4. As for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch","the less damage we cause.2j]3","_j2XAtYz\" (Indicator: \"ac%^t&di#0;uodi^dr$`p^fu9tv[^c","$51","$52","\"|f5xqiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value","$54","identify backup solutions and upload your data.4. As for your data","if we fail to agree","we will try to sell personal information/trade secrets/databases/source codes - generally speaking","everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch","the less damage we cause.)ph>\\[%dubp* =xryi*dnixv])njx$sl?~aan6m|hsoWOB}F6|gc'3Rmw~a]\\{Ei(pwob}f6|gc'3rmw~a]\\{ei(pc0~RY=-u>8\" (Indicator: \"s`qml1aj~8fjfbu&~pnd~7xrkp)g!l[]`<}:\\yc0~ry=-u>8\") in Source: akira_readme.txt.666507834.akira"},{"type":"linebreak"},{"type":"text","value":"$5f"},{"type":"linebreak"},{"type":"text","value":"$60"},{"type":"linebreak"},{"type":"text","value":"-#c^b_r@0tyiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. as for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"$61"},{"type":"linebreak"},{"type":"text","value":"\"8%\"1_Daxet#n*#)$nOH}~y4wfKljwi[.D"},{"type":"linebreak"},{"type":"text","value":"8g\\4u0"},{"type":"linebreak"},{"type":"text","value":"$62"},{"type":"linebreak"},{"type":"text","value":"8g\\4u0"},{"type":"linebreak"},{"type":"text","value":"$63"},{"type":"linebreak"},{"type":"text","value":"$64"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. as for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.&vpy<}g%_.jz6wewyck0\\ysvt2c*u\") in Source: akira_readme.txt.1221958341.akira, \"%HnbFr./c> B)$8$N%*e~K8\\N{u+c6u#A8dw+tJqM!}n>A"},{"type":"linebreak"},{"type":"text","value":"g3Uzex(um+s`|txAb)uiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. As for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.8-'93:_GeYu4`1\"G\"D,Ft27UO3)xi@y+\"P\" (Indicator: \"%hnbfr./c> b)$8$n%*e~k8\\n{u+c6u#a8dw+tjqm!}n>a,g3uzex(um+s`|txab)uiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value"},{"type":"linebreak"},{"type":"text","value":"$65"},{"type":"linebreak"},{"type":"text","value":"ft27uo3)xi@y+\"p\") in Source: akira_readme.txt.2006426956.akira"},{"type":"linebreak"},{"type":"text","value":"$66"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. as for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.9rm\"io+ff(f;3)t:yy#bx)m\") in Source: akira_readme.txt.1350744551.akira"},{"type":"linebreak"},{"type":"text","value":"$67"},{"type":"linebreak"},{"type":"text","value":"$68"},{"type":"linebreak"},{"type":"text","value":"$69"},{"type":"linebreak"},{"type":"text","value":"wulff/](?>:7thugwkt7o4?m\\w(sc]e$2n!%t__\"p?|fiw\")ti]i>w)iles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. as for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.v0fdeen7hekhzkqxv%j~s3es<\") in Source: akira_readme.txt.442292584.akira, \"P4:[BX{dc\\Fb9o{=]o~&o97KuQ=0{>*NeewnE+%~aIYvAK{-wWvLf!_KyRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. As for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.73q~^M W*neewne+%~aiyvak{-wwvlf!_kyriles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. as for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. use this code - 1497-pn-lipx-vltb - to log into our chat.keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.73q~^m wJ9Xh$^Y)WRRiles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value"},{"type":"linebreak"},{"type":"text","value":"$6a"},{"type":"linebreak"},{"type":"text","value":"\"AC%^T&DI#0;uoDi^dr$`P^Fu9tV[^c,\\h2_7z[EvJWy)(0LK!#4k.^\"Yx2iles or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. As for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.2j]3"},{"type":"linebreak"},{"type":"text","value":"_j2XAtYz\" (Indicator: \"ac%^t&di#0;uodi^dr$`p^fu9tv[^c"},{"type":"linebreak"},{"type":"text","value":"$6b"},{"type":"linebreak"},{"type":"text","value":"$6c"},{"type":"linebreak"},{"type":"text","value":"\"|f5xqiles or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value"},{"type":"linebreak"},{"type":"text","value":"$6e"},{"type":"linebreak"},{"type":"text","value":"identify backup solutions and upload your data.4. As for your data"},{"type":"linebreak"},{"type":"text","value":"if we fail to agree"},{"type":"linebreak"},{"type":"text","value":"we will try to sell personal information/trade secrets/databases/source codes - generally speaking"},{"type":"linebreak"},{"type":"text","value":"everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3. Use this code - 1497-PN-LIPX-VLTB - to log into our chat.Keep in mind that the faster you will get in touch"},{"type":"linebreak"},{"type":"text","value":"the less damage we cause.)ph>\\[%dubp* =xryi*dnixv])njx$sl?~aan6m|hsoWOB}F6|gc'3Rmw~a]\\{Ei(pwob}f6|gc'3rmw~a]\\{ei(phttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")","Found URL \"http://www9\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?rszysgeotrust\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows0ecmgddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")","Found URL \"http://www9\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?rszysgeotrust\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp\")","Found URL \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found URL \"https://www.torproject.org/download/.2.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found URL \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007756.00000002.70769.22760000.00000004.mdmp\")","Found URL \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found URL \"https://www.torproject.org/download/.2.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found URL \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www9\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?rszysgeotrust\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows0ecmgddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000001.71286.CA950000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ddz920190417195327.072z0washington1redmond1microsoft\" - Source: \"00000000-00007060.00000002.73207.C9D20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www9\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0uz_]0c0!0a0!1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?rszysgeotrust\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.torproject.org/download/.2.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\" - Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007756.00000002.70769.22760000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.torproject.org/download/.2.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\" - Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"static-86","type":0,"relevance":1,"name":"Imports windows networking related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: win.exe]","description_v2":["Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: win.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: win.exe]"}],"origin":"Static Parser","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-98","type":2,"relevance":1,"name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u\"\n Found HTTPS url \"https://www.torproject.org\"\n Found HTTPS url \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\"","description_v2":["Found HTTPS url \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u\"","Found HTTPS url \"https://www.torproject.org\"","Found HTTPS url \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\""],"description_v3":[{"type":"text","value":"Found HTTPS url \"https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u\""},{"type":"linebreak"},{"type":"text","value":"Found HTTPS url \"https://www.torproject.org\""},{"type":"linebreak"},{"type":"text","value":"Found HTTPS url \"https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.3.\""}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-103","type":13,"relevance":5,"name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\"\n YARA signature for AES encryption matched on file \"sample.bin\"","description_v2":["YARA signature for AES encryption matched on file \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\"","YARA signature for AES encryption matched on file \"sample.bin\""],"description_v3":[{"type":"text","value":"YARA signature for AES encryption matched on file \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on file \"sample.bin\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-436","type":2,"relevance":1,"name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"win.exe\")","description_v2":["Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1021.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1021/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"svchost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sedsvc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"svchost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"sedsvc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"svchost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-141","type":6,"relevance":2,"name":"Calls an API typically used to retrieve computer name","description":"\"sedsvc.exe\" called \"GetComputerNameW\" (UID: 00000000-00007060)","description_v2":["\"sedsvc.exe\" called \"GetComputerNameW\" (UID: 00000000-00007060)"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" called \"GetComputerNameW\" (UID: 00000000-00007060)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")\n Found string \"nd AES C\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","description_v2":["Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"nd AES C\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"nd AES C\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-80","type":2,"relevance":1,"name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"win.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"win.exe\")","Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"$76","description_v2":["Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"win.exe\")","Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"win.exe\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"win.exe\")","Found reference to API \"83509040740,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83449352659,7008,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83488674707,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83508586458,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83504964528,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83509157720,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83447121564,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83486996475,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83493776324,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83487447404,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83504458964,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83417213978,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"83462522768,7008,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")","Found reference to API \"155343737214,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.671\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155561637320,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.750\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"152039434221,3972,3114,,FindNextFileW,kernel32.dll,\"00:18:24.281\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155197603183,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.609\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"154779072631,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.437\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155561511283,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.750\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155511774765,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155602189582,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.765\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","Found reference to API \"155511331584,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83509040740,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83449352659,7008,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83488674707,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83508586458,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83504964528,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83509157720,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83447121564,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83486996475,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83493776324,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83487447404,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83504458964,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83417213978,3972,3114,,FindNextFileW,kernel32.dll,\"00:17:55.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83462522768,7008,3114,,FindNextFileW,kernel32.dll,\"00:17:55.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155343737214,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.671\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155561637320,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.750\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"152039434221,3972,3114,,FindNextFileW,kernel32.dll,\"00:18:24.281\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155197603183,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.609\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"154779072631,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.437\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155561511283,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.750\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155511774765,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155602189582,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.765\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"155511331584,7008,3114,,FindNextFileW,kernel32.dll,\"00:18:25.734\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"$77","description_v2":["Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")","Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; File: \"win.exe\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"win.exe\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-84","type":2,"relevance":1,"name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"win.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"win.exe\")","Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"win.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"win.exe\")","Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"win.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"win.exe\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$78","description_v2":["Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; File: \"win.exe\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"win.exe\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"win.exe\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-478","type":2,"relevance":1,"name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"win.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"win.exe\")","Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-394","type":2,"relevance":1,"name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; File: \"win.exe\")\n Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; File: \"win.exe\")","Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Get-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"win.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"win.exe\")","Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-475","type":2,"relevance":1,"name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; File: \"win.exe\")\n file/memory contains long string with (Indicator: \"secret\"; File: \"akira_readme.txt\")\n file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp, 00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"secret\"; File: \"win.exe\")","file/memory contains long string with (Indicator: \"secret\"; File: \"akira_readme.txt\")","file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp, 00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"secret\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"secret\"; File: \"akira_readme.txt\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00007756.00000001.68850.227B5000.00000004.mdmp, 00000000-00007756.00000002.70769.227B5000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-88","type":0,"relevance":1,"name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: win.exe]","description_v2":["Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: win.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: win.exe]"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-507","type":2,"relevance":1,"name":"References to WMI query strings used for information discovery","description":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; File: \"win.exe\")\n Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; File: \"win.exe\")","Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"$79","description_v2":["\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.034.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" with delete access","\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" with delete access"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" opened \"%PROGRAMFILES%\\rempl\\Logs\\ServiceRemediation.034.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.033.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.032.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.031.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.030.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.029.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.028.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.027.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.026.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.025.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.024.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.023.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.022.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.021.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.020.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.019.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.018.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.017.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.016.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.015.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.014.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.013.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.012.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.011.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" opened \"C:\\Program Files\\rempl\\Logs\\ServiceRemediation.010.etl\" with delete access"}],"origin":"API Call","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"$7a","description_v2":["Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \"\\Device\\HarddiskVolume2\\Program Files\\rempl\\sedsvc.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp\")","Found string \"\\Device\\HarddiskVolume2\\win.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%PROGRAMFILES%\\rempl\\sedsvc.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007060.00000000.69367.C9DE0000.00000004.mdmp, 00000000-00007060.00000001.71286.C9DE0000.00000004.mdmp, 00000000-00007060.00000002.73207.C9DE0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Z:\\win.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007756.00000001.68850.22760000.00000004.mdmp, 00000000-00007756.00000002.70769.22760000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-369","type":2,"relevance":1,"name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; File: \"win.exe\")\n Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; File: \"win.exe\")","Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"powershell.exe -Command \"Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\"\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-308","type":2,"relevance":1,"name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"win.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"win.exe\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-230","type":2,"relevance":1,"name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-407","type":2,"relevance":1,"name":"Contains ability to format disks","description":"Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"win.exe\")\n Found string \"format specifier requires signed argument\" (Indicator: \"format \"; File: \"win.exe\")","description_v2":["Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"win.exe\")","Found string \"format specifier requires signed argument\" (Indicator: \"format \"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"format specifier requires signed argument\" (Indicator: \"format \"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1561.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1561/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-426","type":2,"relevance":1,"name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"win.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"win.exe\")","Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1222","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1222","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"win.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"win.exe\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-535","type":2,"relevance":0,"name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"win.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")","description_v2":["Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"win.exe\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"win.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007756.00000002.70769.3A514000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-19","type":3,"relevance":10,"name":"Modifies Software Policy Settings","description":"$7b","description_v2":["\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\")","\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$7c","description_v2":["\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\UNISTORESVC\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PIMINDEXMAINTENANCESVC\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\USERDATASVC\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\MESSAGINGSERVICE\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WPNUSERSERVICE\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CDPUSERSVC\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\"; Key: \"ALIAS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEDLL\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEMANIFEST\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEMAIN\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEDLLUNLOADONSTOP\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")","\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\UNISTORESVC\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PIMINDEXMAINTENANCESVC\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\USERDATASVC\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\MESSAGINGSERVICE\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WPNUSERSERVICE\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CDPUSERSVC\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\"; Key: \"ALIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEDLL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEMANIFEST\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEMAIN\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ONESYNCSVC\\PARAMETERS\"; Key: \"SERVICEDLLUNLOADONSTOP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-123","type":3,"relevance":5,"name":"Reads service groups entries related keys","description":"$7d","description_v2":["\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\"; Key: \"UNISTACKSVCGROUP\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYPARAM\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWLOWBOX\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWINTERACTIVEUSERS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWCOMCAPABILITY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"AUTHENTICATIONLEVEL\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"IMPERSONATIONLEVEL\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"AUTHENTICATIONCAPABILITIES\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYAPPID\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COM_UNMARSHALINGPOLICY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COM_ROSETTINGS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"DEFAULTRPCSTACKSIZE\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"RPCEXCEPTIONFILTERMODE\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"SYSTEMCRITICAL\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"NOGUIACCESS\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"DYNAMICCODEPOLICY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"BINARYSIGNATUREPOLICY\"; Value: \"\")","\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"EXTENSIONPOINTSPOLICY\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\"; Key: \"UNISTACKSVCGROUP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYPARAM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWLOWBOX\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWINTERACTIVEUSERS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYALLOWCOMCAPABILITY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"AUTHENTICATIONLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"IMPERSONATIONLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"AUTHENTICATIONCAPABILITIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COINITIALIZESECURITYAPPID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COM_UNMARSHALINGPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"COM_ROSETTINGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"DEFAULTRPCSTACKSIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"RPCEXCEPTIONFILTERMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"SYSTEMCRITICAL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"NOGUIACCESS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"DYNAMICCODEPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"BINARYSIGNATUREPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SVCHOST\\UNISTACKSVCGROUP\"; Key: \"EXTENSIONPOINTSPOLICY\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-136","type":3,"relevance":3,"name":"Writes registry keys","description":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4700000000000000\")\n \"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\CLASSES\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4800000000000000\")\n \"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4900000000000000\")\n \"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4A00000000000000\")","description_v2":["\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4700000000000000\")","\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\CLASSES\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4800000000000000\")","\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4900000000000000\")","\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4A00000000000000\")"],"description_v3":[{"type":"text","value":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4700000000000000\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\CLASSES\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4800000000000000\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4900000000000000\")"},{"type":"linebreak"},{"type":"text","value":"\"sedsvc.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMEDIATION\\LOCALSTATE\\TELEMETRYPLUGIN\"; Key: \"GLOBALEVENTCOUNTER\"; Value: \"4A00000000000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-455","type":2,"relevance":3,"name":"Contains reference to multiple windows system processes","description":"Found strings \"spoolsv.exe,lsass.exe,winlogon.exe,services.exe,csrss.exe\" (File: \"win.exe\")","description_v2":["Found strings \"spoolsv.exe,lsass.exe,winlogon.exe,services.exe,csrss.exe\" (File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found strings \"spoolsv.exe,lsass.exe,winlogon.exe,services.exe,csrss.exe\" (File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-354","type":2,"relevance":1,"name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")","Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007060.00000001.71286.D10FB000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-481","type":2,"relevance":1,"name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"win.exe\")","description_v2":["Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"string-586","type":2,"relevance":1,"name":"Contains ability to disable driver signature enforcement","description":"Found string \"[2024-01-13 09:18:21.214] [file_logger] [error] File handle not found! (C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui)\" (Indicator: \"ci.dll\"; File: \"Log-13-01-2024-09-15-40.txt\")","description_v2":["Found string \"[2024-01-13 09:18:21.214] [file_logger] [error] File handle not found! (C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui)\" (Indicator: \"ci.dll\"; File: \"Log-13-01-2024-09-15-40.txt\")"],"description_v3":[{"type":"text","value":"Found string \"[2024-01-13 09:18:21.214] [file_logger] [error] File handle not found! (%PROGRAMFILES%\\(x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui)\" (Indicator: \"ci.dll\"; File: \"Log-13-01-2024-09-15-40.txt\")"}],"origin":"File/Memory","attck_id":"T1553.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/006","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"$7e","description_v2":["\"akira_readme.txt.1249788089.akira\" has type \"DOS executable (COM 0x8C-variant)\"- [targetUID: N/A]","\"akira_readme.txt.3813450109.akira\" has type \"COM executable for DOS\"- [targetUID: N/A]","\"ff86a65c3e912382c84af727d18c581c.arika\" has type \"MIPSEB ECOFF executable not stripped - version 46.71\"- [targetUID: N/A]","\"b400d9141a4af05e0e5b80416dde8650.arika\" has type \"mc68k executable (shared demand paged) not stripped\"- [targetUID: N/A]","\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 112.127\"- [targetUID: N/A]","\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"amd 29k coff noprebar executable\"- [targetUID: N/A]","\"cbe848a7be7a5f807d4f31988c393758.arika\" has type \"MIPSEB MIPS-II ECOFF executable not stripped - version 11.75\"- [targetUID: N/A]","\"5d6bec0ebd2a2d1d87e7006133aa6b87.arika\" has type \"VAX-order 68K Blit (standalone) executable\"- [targetUID: N/A]","\"0928c463e5e5624fbd3d9f0b23d52add.arika\" has type \"370 XA sysV pure executable - version 9023\"- [targetUID: N/A]","\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 86.155\"- [targetUID: N/A]","\"bb8ca3cd12aa5af1e61fe68e340721e3.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 87.110\"- [targetUID: N/A]","\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 249.4\"- [targetUID: N/A]","\"65f18c22a26d786d58baf03327b3a4b6.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 98.26\"- [targetUID: N/A]"],"description_v3":[{"type":"text","value":"\"akira_readme.txt.1249788089.akira\" has type \"DOS executable (COM 0x8C-variant)\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"akira_readme.txt.3813450109.akira\" has type \"COM executable for DOS\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"ff86a65c3e912382c84af727d18c581c.arika\" has type \"MIPSEB ECOFF executable not stripped - version 46.71\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"b400d9141a4af05e0e5b80416dde8650.arika\" has type \"mc68k executable (shared demand paged) not stripped\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 112.127\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"aa60201ecad4ee62b254dda53e6c8857.arika\" has type \"amd 29k coff noprebar executable\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"cbe848a7be7a5f807d4f31988c393758.arika\" has type \"MIPSEB MIPS-II ECOFF executable not stripped - version 11.75\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"5d6bec0ebd2a2d1d87e7006133aa6b87.arika\" has type \"VAX-order 68K Blit (standalone) executable\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"0928c463e5e5624fbd3d9f0b23d52add.arika\" has type \"370 XA sysV pure executable - version 9023\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 86.155\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"bb8ca3cd12aa5af1e61fe68e340721e3.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 87.110\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"c296cd35d2f45e3f4c93ffa16140d11b.arika\" has type \"MIPSEB MIPS-III ECOFF executable not stripped - version 249.4\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"65f18c22a26d786d58baf03327b3a4b6.arika\" has type \"MIPSEL-BE ECOFF executable not stripped - version 98.26\"- [targetUID: N/A]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"binary-10","type":8,"relevance":5,"name":"The input sample dropped very many files","description":"The input sample dropped 1287 files (often an indicator for ransomware)","description_v2":["The input sample dropped 1287 files (often an indicator for ransomware)"],"description_v3":[{"type":"text","value":"The input sample dropped 1287 files (often an indicator for ransomware)"}],"origin":"Binary File","attck_id":"T1491.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1491/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"string-30","type":2,"relevance":3,"name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"win.exe\")","description_v2":["Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"win.exe\")"],"description_v3":[{"type":"text","value":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"win.exe\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetFileAttributesA\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n SleepEx\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetSystemInfo\n GetCommandLineW\n SleepConditionVariableSRW\n GetCommandLineA\n GetModuleHandleW\n GetFileAttributesExW\n Sleep\n WSAStartup","description_v2":["GetDriveTypeW","GetFileAttributesA","GetFileAttributesW","UnhandledExceptionFilter","WriteFile","GetModuleFileNameW","IsDebuggerPresent","LoadLibraryExW","CreateThread","ExitThread","TerminateProcess","GetModuleHandleExW","SleepEx","OpenProcess","GetStartupInfoW","CreateDirectoryW","DeleteFileW","GetFileSizeEx","FindNextFileW","FindFirstFileW","FindFirstFileExW","GetProcAddress","CreateFileW","GetSystemInfo","GetCommandLineW","SleepConditionVariableSRW","GetCommandLineA","GetModuleHandleW","GetFileAttributesExW","Sleep","WSAStartup"],"description_v3":[{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesA"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"UnhandledExceptionFilter"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"ExitThread"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW"},{"type":"linebreak"},{"type":"text","value":"SleepEx"},{"type":"linebreak"},{"type":"text","value":"OpenProcess"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"GetFileSizeEx"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"GetSystemInfo"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"SleepConditionVariableSRW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineA"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesExW"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-8","type":12,"relevance":10,"name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","description_v2":["CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)"],"description_v3":[{"type":"text","value":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"tor","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":null,"windows_version_edition":null,"windows_version_service_pack":null,"windows_version_version":null,"windows_version_bitness":null,"custom_date_time":null,"sandbox_version":"11.0.4","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["Found a string that may be used as part of an injection method"]}],"icon":null,"visualization":"$7f","classification":["48.7% (.EXE) Win64 Executable (generic)","23.3% (.EXE) Win16 NE executable (generic)","9.3% (.EXE) OS/2 Executable (generic)","9.2% (.EXE) Generic Win/DOS Executable","9.2% (.EXE) DOS Executable Generic"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":null,"port_infos":[],"extracted_strings":{"all":[{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlae3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjKiQlJicoKiop","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"IV9pc19kb3VibGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"IXgtc3lzLWRlZmF1bHQtbG9jYWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Il9fXyIiJyIiIiIiJyI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_6.png","compromised":null,"detection_total":null,"total":null},{"value":"IyUmKDM4OkhKTFBTVVZYWlxeYGNlZmtzeH0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$80","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1221958341.akira","compromised":null,"detection_total":null,"total":null},{"value":"JD5cdCQ+ZDgkPlQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JEZ1bmN0aW9u","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JFJlY3ljbGUuQmlu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJFQ1lDTEUuQklO","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWMwempuU3YkJ3R9ZysoS0ZCLjlLKDcpb0U=","type":"Ansi","source":"File String Dumps","process":null,"filename":"28385dac25a7fab3008c9600a790f886.arika","compromised":null,"detection_total":null,"total":null},{"value":"$81","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2006426956.akira","compromised":null,"detection_total":null,"total":null},{"value":"JU9aVEU/YFJyK3ItKFY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"StartupProfileData-NonInteractive.519289526.akira","compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVccmVtcGxcc2VkcGx1Z2lucy5kbGw=","type":"Unicode","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVktJW0tJWQgJUg6JU06JVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JmpMJjZabDY/QX4/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JyBhbHJlYWR5IGV4aXN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JywlQXZoRkJsZjRPJ3FTbiB9JUM0UHNSZmVnLngzcmoyak1nc09u","type":"Ansi","source":"File String Dumps","process":null,"filename":"f27cb9a5b89a0c69336fc456c1f75939.arika","compromised":null,"detection_total":null,"total":null},{"value":"J15cbGxJcydyMnxTfG40bERxRDI2Q2dhV0pGTCQreHZs","type":"Ansi","source":"File String Dumps","process":null,"filename":"b8317dfbabaa3a1285bdadaca9157ad1.arika","compromised":null,"detection_total":null,"total":null},{"value":"J3pOYzhOZWs6cWhATWEkRUhyd1NLTzJzQi5ofW45QQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"bfaf6734393b3852e4fe5790557b1648.arika","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$82","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3946409587.akira","compromised":null,"detection_total":null,"total":null},{"value":"KEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwgYmVnaW4pIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwgYmVnaW4pIENpcGhlciBpcyBub3QgaW5pdGlhbGl6ZSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwgYmVnaW4pIEVuY3J5cHQgZXhjZXB0aW9uOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwpIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwpIENpcGhlciBpcyBub3QgaW5pdGlhbGl6ZSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwpIEVuY3J5cHQgZXhjZXB0aW9uOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFBhcnQpIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFBhcnQpIENpcGhlciBpcyBub3QgaW5pdGlhbGl6ZSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFBhcnQpIEVuY3J5cHQgZXhjZXB0aW9uOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$83","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.209225444.akira","compromised":null,"detection_total":null,"total":null},{"value":"KTE0Nzo7PUlKXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KTE0OjtFRklKXmRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KTE0OkVGSUpOT2RlXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KVIvemIkPU5pMUJHbHwlfDZJdH5nQ2lZJCAxZF8kbFc=","type":"Ansi","source":"File String Dumps","process":null,"filename":"__PSScriptPolicyTest_doe4olli.wci.ps1.228370578.akira","compromised":null,"detection_total":null,"total":null},{"value":"KioqKioqKioqKioqKioqKioqKio=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"K0FSKUdiMyY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"1f3b562353ebab0e935a995fcceb19d5.arika","compromised":null,"detection_total":null,"total":null},{"value":"LGZFTnlGIDhwLWRxRDUqN0h2eGFf","type":"Ansi","source":"File String Dumps","process":null,"filename":"49d066db5c6bfd42d23b409e7eb37e77.arika","compromised":null,"detection_total":null,"total":null},{"value":"LS1lbmNyeXB0aW9uX3BhdGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LS1lbmNyeXB0aW9uX3BlcmNlbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LS1zaGFyZV9maWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LWhAanI1cic6XW8hUExVeU4/c0s0Vy1PR29cT3R+U2p7Xl54SWFIJA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"0f13fcd5c1b4cf4867c64cef38493ee0.arika","compromised":null,"detection_total":null,"total":null},{"value":"LWsgdW5pc3RhY2tzdmNncm91cA==","type":"Ansi","source":"Process Commandline","process":"svchost.exe","filename":"svchost.exe","compromised":null,"detection_total":null,"total":null},{"value":"LWxvY2Fsb25seQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVV9DcnRfbmV3X2RlbGV0ZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWN0eXBlX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0V4Y2VwdGlvblB0cl9zdGF0aWNAVmJhZF9hbGxvY0BzdGRAQEA/QTB4NmUwMmVmZTVAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0V4Y2VwdGlvblB0cl9zdGF0aWNAVmJhZF9leGNlcHRpb25Ac3RkQEBAP0EweDZlMDJlZmU1QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0lvc2JASEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFVfRGlyX2VudW1faW1wbEBmaWxlc3lzdGVtQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFVfUmVjdXJzaXZlX2Rpcl9lbnVtX2ltcGxAZmlsZXN5c3RlbUBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JGJhc2ljX2ZpbGVfc2lua0BWbXV0ZXhAc3RkQEBAc2lua3NAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JGJhc2ljX3JhbmRvbV9hY2Nlc3NfaGFuZGxlQFZhbnlfaW9fZXhlY3V0b3JAYXNpb0BAQHdpbmRvd3NAYXNpb0BAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JHdpbmNvbG9yX3N0ZG91dF9zaW5rQFVjb25zb2xlX211dGV4QGRldGFpbHNAc3BkbG9nQEBAc2lua3NAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZsb2dnZXJAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZ0aHJlYWRfcG9vbEBhc2lvQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZUaHJlYWRQb29sQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwN0B0aHJlYWRfcG9vbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwQUBAaW9fY29udGV4dEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwQUBAdGhyZWFkX3Bvb2xAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZmlsZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZmlsZWJ1ZkBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaWZzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmluZ3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAVj8kYWxsb2NhdG9yQF9XQDJAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBEJDBCUEVAVj8kYWxsb2NhdG9yQERAc3RkQEBAdjlAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBEJDBQS0BWPyRhbGxvY2F0b3JAREBzdGRAQEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBIJDBCUEVAVj8kYWxsb2NhdG9yQEhAc3RkQEBAdjlAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBJJDBDQUBWPyRhbGxvY2F0b3JASUBzdGRAQEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb2ZzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb3N0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBWPyRhbGxvY2F0b3JAX1dAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQERAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQEhAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQElAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQ19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQ19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY2FuY2VsbGF0aW9uX2hhbmRsZXJAVmlvY3Bfb3BfY2FuY2VsbGF0aW9uQHdpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBERFVfTWJzdGF0ZXRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMDBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMERMSktNS0FBQEBzdGRAQEBjaHJvbm9Ac3RkQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMERPSUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMFBFQ0VBQEBzdGRAQEBjaHJvbm9Ac3RkQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDAwQHN0ZEBAQGNocm9ub0BzdGRAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBETEpLTUtBQUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBET0lAQHN0ZEBAQGNocm9ub0BzdGRAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBQRUNFQUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZudWxsX3JlYWN0b3JAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZzY2hlZHVsZXJAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZ3aW5faW9jcF9oYW5kbGVfc2VydmljZUBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZ3aW5faW9jcF9pb19jb250ZXh0QGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZnVuY0BVdGhyZWFkX2Z1bmN0aW9uQHRocmVhZF9wb29sQGFzaW9AQEB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZnVuY0BVdGhyZWFkX2Z1bmN0aW9uQHdpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQEB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kaXRlcmF0b3JfYnVmZmVyQFY/JGJhY2tfaW5zZXJ0X2l0ZXJhdG9yQFY/JGJhc2ljX21lbW9yeV9idWZmZXJARCQwUEtAVj8kYWxsb2NhdG9yQERAc3RkQEBAdjlAZm10QEBAc3RkQEBEVWJ1ZmZlcl90cmFpdHNAZGV0YWlsQHY5QGZtdEBAQGRldGFpbEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbGV2ZWxfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbGV2ZWxfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbmFtZV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbmFtZV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX2dldEBfV1Y/JGlzdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBEVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcGlkX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcGlkX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kUl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kUl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kU19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kU19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfZmlsZW5hbWVfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfZmlsZW5hbWVfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfbGV2ZWxfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfbGV2ZWxfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2ZpbGVuYW1lX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2ZpbGVuYW1lX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2Z1bmNuYW1lX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2Z1bmNuYW1lX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xpbmVudW1fZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xpbmVudW1fZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xvY2F0aW9uX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xvY2F0aW9uX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kVF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kVF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVm51bGxfcmVhY3RvckBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVnNjaGVkdWxlckBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVndpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVndpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kd2luY29sb3Jfc2lua0BVY29uc29sZV9tdXRleEBkZXRhaWxzQHNwZGxvZ0BAQHNpbmtzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kd2luY29sb3Jfc3Rkb3V0X3NpbmtAVWNvbnNvbGVfbXV0ZXhAZGV0YWlsc0BzcGRsb2dAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kWV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kWV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kel9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kel9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9FeGNlcHRpb25QdHJfbm9ybWFsQD9BMHg2ZTAyZWZlNUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9GYWNldF9iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeTJAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9SZWZfY291bnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmFnZ3JlZ2F0ZV9mb3JtYXR0ZXJAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9jYXN0QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGVjdXRvckBleGVjdXRpb25AYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF93ZWFrX3B0ckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNhbmNlbGxhdGlvbl9oYW5kbGVyX2Jhc2VAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNoX2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvZGVjdnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbG9yX3N0YXJ0X2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbG9yX3N0b3BfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmVycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhY2V0QGxvY2FsZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZpbGVzeXN0ZW1fZXJyb3JAZmlsZXN5c3RlbUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZsYWdfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdF9lcnJvckB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdHRlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZ1bGxfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZ1bmNfYmFzZUB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfYXJndW1lbnRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfc2VydmljZV9vd25lckBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlvc19iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2dlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm1pc2NfY2F0ZWdvcnlAZGV0YWlsQGVycm9yQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm11bHRpcGxlX2V4Y2VwdGlvbnNAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm5vbmNvcHlhYmxlQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm51bGxfcmVhY3RvckBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhdHRlcm5fZm9ybWF0dGVyQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlckBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlcl90YXNrQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNlcnZpY2VAZXhlY3V0aW9uX2NvbnRleHRAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNlcnZpY2VfYWxyZWFkeV9leGlzdHNAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNpbmtAc2lua3NAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNwZGxvZ19leEBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfaW50ZXJmYWNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfd2luN0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX2ludGVyZmFjZUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX3dpbjdAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9jYXRlZ29yeUBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnRocmVhZF9jb250ZXh0QGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVndpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVndpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LlxvRnM5YixsM0AiQXd8S0BRZjVkNzg+W34=","type":"Ansi","source":"File String Dumps","process":null,"filename":"19a1ce0a17637330562bac2838d89751.arika","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkRgKF5zfUw8QFIqeT9CeDwtdF1zOX0+czZCckA9ZS00R3IyPE9l","type":"Ansi","source":"File String Dumps","process":null,"filename":"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika","compromised":null,"detection_total":null,"total":null},{"value":"LmRhZGlhZ3JhbXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LmRhc2NoZW1h","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LlA3VXcgYzBWMD9lWHY2PG8paEROM2JWPSU6","type":"Ansi","source":"File String Dumps","process":null,"filename":"5d6bec0ebd2a2d1d87e7006133aa6b87.arika","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHZvbHRtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnNhczdiZGF0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnNxbGl0ZTM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnNxbGl0ZWRi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnRleHQkbW4kMDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lz9vYHl7OiIxcTZsTnFoSQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"1f3b562353ebab0e935a995fcceb19d5.arika","compromised":null,"detection_total":null,"total":null},{"value":"L0R7ezt6WXRsRHl7WmV6JQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"a9c9d466d235f1a4356a673056a7cad6.arika","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMDAwMDBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMTAyMDMwNDA1MDYwNzA4MDkxMDExMTIxMzE0MTUxNjE3MTgxOTIwMjEyMjIzMjQyNTI2MjcyODI5MzAzMTMyMzMzNDM1MzYzNzM4Mzk0MDQxNDI0MzQ0NDU0NjQ3NDg0OTUwNTE1MjUzNTQ1NTU2NTc1ODU5NjA2MTYyNjM2NDY1NjY2NzY4Njk3MDcxNzI3Mzc0NzU3Njc3Nzg3OTgwODE4MjgzODQ4NTg2ODc4ODg5OTA5MTkyOTM5NDk1OTY5Nzk4OTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRmFiY2RlZi0rWHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRmFiY2RlZi0rWHhQcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDQyZWEyMTQtODMwYy01OTc5LTg2ZjUtMjhmZDkyYzgwZjMw","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDRhNDkwZDQtODRjNi00OTIwLTljMjItNTFjODA4MjVmZjJj","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDRlY2NmOGUtODQ5MC00YWQxLThlZDUtMGFlNzc1MGU2OWU2","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MEFeQV1BXF5b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEFfQV1BXF5b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEFfQV5BXF9e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEFfQV5BXUFcXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEFfQV5BXUFcX15b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"MGJkMTk5MDktZWI2Zi00YjE2LTgwNzQtNmRjZTgwM2YwOTFk","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MFMoJVNwPDIzUw==","type":"Ansi","source":"File String Dumps","process":null,"filename":"__PSScriptPolicyTest_yq1pgmhs.bfk.psm1.2103115049.akira","compromised":null,"detection_total":null,"total":null},{"value":"MFRAaTFLUzZzIg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"f2f3bff04c2404ee96242a718e3c98ef.arika","compromised":null,"detection_total":null,"total":null},{"value":"MS4gRGVhbGluZyB3aXRoIHVzIHlvdSB3aWxsIHNhdmUgQSBMT1QgZHVlIHRvIHdlIGFyZSBub3QgaW50ZXJlc3RlZCBpbiBydWluaW5nIHlvdXIgZmluYW5jaWFsbHkuIFdlIHdpbGwgc3R1ZHkgaW4gZGVwdGggeW91ciBmaW5hbmNlLCBiYW5rICYgaW5jb21lIHN0YXRlbWVudHMsIHlvdXIgc2F2aW5ncywgaW52ZXN0bWVudHMgZXRjLiBhbmQgcHJlc2VudCBvdXIgcmVhc29uYWJsZSBkZW1hbmQgdG8geW91LiBJZiB5b3UgaGF2ZSBhbiBhY3RpdmUgY3liZXIgaW5zdXJhbmNlLCBsZXQgdXMga25vdyBhbmQgd2Ugd2lsbCBndWlkZSB5b3UgaG93IHRvIHByb3Blcmx5IHVzZSBpdC4gQWxzbywgZHJhZ2dpbmcgb3V0IHRoZSBuZWdvdGlhdGlvbiBwcm9jZXNzIHdpbGwgbGVhZCB0byBmYWlsaW5nIG9mIGEgZGVhbC4=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8u","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":0,"total":91},{"value":"MTI1NjM4NzUtYjI3YS0xMWVlLTljMmEtMDgwMDI3Y2NiOWFm","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTM5MjAwMjhBM0JENDA3NQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$84","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3040952710.akira","compromised":null,"detection_total":null,"total":null},{"value":"MWYiaTooLm1iI0twLUE9OSVwNkFJZ0Z3KW91PVhAdWkgODxPbzIgOjU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c4230ef51e48c3575bae17f9a5db1a64.arika","compromised":null,"detection_total":null,"total":null},{"value":"MVo5OHs8MjwuSyptdGV4fGU6bFRgTEhUJ2o7MVRlJ1ZJ","type":"Ansi","source":"File String Dumps","process":null,"filename":"ad4aba8d31dc374d4be575aca47156a4.arika","compromised":null,"detection_total":null,"total":null},{"value":"Mi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"Mi4gUGF5aW5nIHVzIHlvdSBzYXZlIHlvdXIgVElNRSwgTU9ORVksIEVGRk9SVFMgYW5kIGJlIGJhY2sgb24gdHJhY2sgd2l0aGluIDI0IGhvdXJzIGFwcHJveGltYXRlbHkuIE91ciBkZWNyeXB0b3Igd29ya3MgcHJvcGVybHkgb24gYW55IGZpbGVzIG9yIHN5c3RlbXMsIHNvIHlvdSB3aWxsIGJlIGFibGUgdG8gY2hlY2sgaXQgYnkgcmVxdWVzdGluZyBhIHRlc3QgZGVjcnlwdGlvbiBzZXJ2aWNlIGZyb20gdGhlIGJlZ2lubmluZyBvZiBvdXIgY29udmVyc2F0aW9uLiBJZiB5b3UgZGVjaWRlIHRvIHJlY292ZXIgb24geW91ciBvd24sIGtlZXAgaW4gbWluZCB0aGF0IHlvdSBjYW4gcGVybWFuZW50bHkgbG9zZSBhY2Nlc3MgdG8gc29tZSBmaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAu","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MjViOTlhNGMtMmY4MC00ZmNkLTk4MmQtNjljZDFmNzdiYWRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MmBxQT1gRkllIT9WeXBVRzU1MmZJZS8oUE5TJVJjZzVXd1JRQA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"bffefc39245ad7926b2499b5e39c1e75.arika","compromised":null,"detection_total":null,"total":null},{"value":"MmM2W2hIN2NCPjdzYUFDVX4nbkJ3cXhSeXIsbWJqJiBbTg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"807fe50e81655798c69e650b760fd8ed.arika.1987755882.akira","compromised":null,"detection_total":null,"total":null},{"value":"MmNicHxJeXk5InFXZ3U1N1lhLFs8cFplKF13TDY2Izl9JFZ1MTM=","type":"Ansi","source":"File String Dumps","process":null,"filename":"bb8ca3cd12aa5af1e61fe68e340721e3.arika","compromised":null,"detection_total":null,"total":null},{"value":"MmNMflxqXl8qdV5eSkYvTyI+QCdJUQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"20393be1207297eef5a8e3d40ac08771.arika","compromised":null,"detection_total":null,"total":null},{"value":"$85","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1717193171.akira","compromised":null,"detection_total":null,"total":null},{"value":"MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":0,"total":182},{"value":"Mkt8aDNQLVxheS5fJClxTE84N19kR0Zk","type":"Ansi","source":"File String Dumps","process":null,"filename":"4e0b2678720cbea7115590fd585dcb1d.arika","compromised":null,"detection_total":null,"total":null},{"value":"MlRrQWIxeEN3PSd5RV82fCZ9KTolPD43Ig==","type":"Ansi","source":"File String Dumps","process":null,"filename":"e0ab6679f54a95168d634f7a8952f5f6.arika","compromised":null,"detection_total":null,"total":null},{"value":"MnhrWElCPitlM15FKGx1PFxrQihRd2ssO24tPmc9Vi1ATSc=","type":"Ansi","source":"File String Dumps","process":null,"filename":"4efc119d14b62a4f100a0b56433829d8.arika","compromised":null,"detection_total":null,"total":null},{"value":"Mnh9JipWX2E6dHUuVT5hdyx+QTdFeSY7PEFzRWxlVXNKKSA8","type":"Ansi","source":"File String Dumps","process":null,"filename":"6e34fe71c6b2a5b4463de32229cc7fac.arika","compromised":null,"detection_total":null,"total":null},{"value":"My4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"My4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQu","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MzdlYzBmMzUtMDI2ZS01ZTdlLWQzZDQtODBmMzI1NDdiZmZm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M3IgM3okM1ooRDNaLEQzUjBEM0I4M0o8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"NC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24u","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"NDAyNWQxOTItMjczZC00MmVjLWJkZjgtOTQwZWMzNGVlZGNh","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDE4QTA2M0VBM0JDMDg3NQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDE4QTA2M0VBM0JDMzg3NQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NFxmLSQzaUglb3p0YGREJlcqdnlEKCxXa3Nk","type":"Ansi","source":"File String Dumps","process":null,"filename":"7b647b3fc5604977780d212cc5884a2b.arika","compromised":null,"detection_total":null,"total":null},{"value":"$86","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3813450109.akira","compromised":null,"detection_total":null,"total":null},{"value":"NS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"NTA5YjAwOWItZDhlYi00ZjdkLWExMmItYTIzMjE4YmZjYTg0","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWhHSVZaODdvKycvbVN2MmU/LX1AaURWNDlCRGQnJWFmTA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"c4230ef51e48c3575bae17f9a5db1a64.arika","compromised":null,"detection_total":null,"total":null},{"value":"N2FjNWViNzEtM2M1MS01MDg5LTFiNGUtODdhNDZiZDZiNGRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2ZjYjk3OTEtZjQ4MS00NmQxLTg0NmUtMmViNmYwMDNjNGQz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$87","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2181991362.akira","compromised":null,"detection_total":null,"total":null},{"value":"ODI1NWQ0NmYtMjg4MS00NzUzLTg1NjctMGQxOTYyOGY4OGU0","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODNhOTI3N2EtZDJmYy00YjM0LWJmODEtOGNlYjQ0MDc4MjRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"OEw5Z1B0MUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"OWE1NWQ5NTMtYmMyNy00NDMwLWEyNDgtNmRhMjRmMmU5OWI3","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OW9QKnZjZiE9Ri1pWExvKGUlSUk9QG1+O3pGcGhn","type":"Ansi","source":"File String Dumps","process":null,"filename":"19a1ce0a17637330562bac2838d89751.arika","compromised":null,"detection_total":null,"total":null},{"value":"OjVGJVtdPklULE8=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c2cb4185f98b5038bdbf00930ce011a3.arika","compromised":null,"detection_total":null,"total":null},{"value":"OjtzPSM/M3A1PiZBKHB+V15HPS4=","type":"Ansi","source":"File String Dumps","process":null,"filename":"aa60201ecad4ee62b254dda53e6c8857.arika","compromised":null,"detection_total":null,"total":null},{"value":"OmpsbDNtXUpZV1I5K3o7dGpOR3M1JkZRNzBLXzxCdShzYjE4W3A3JXw9dUxhIV8nXjNcPnBVNSIkTEg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.3437759144.akira","compromised":null,"detection_total":null,"total":null},{"value":"OnN2STI8VGxsPEd9OWdyJzFXVT9ILHQ0LyN7fVpq","type":"Ansi","source":"File String Dumps","process":null,"filename":"4693c292253ca448687098647bbcd539.arika","compromised":null,"detection_total":null,"total":null},{"value":"$88","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3790783025.akira","compromised":null,"detection_total":null,"total":null},{"value":"O2I5ezx+NSROUD9LVDRUdjViIHVxXG9bbA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"203721ed3294a927987dc568783f9d86.arika","compromised":null,"detection_total":null,"total":null},{"value":"O2QyMlZ0OjpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"O0k5fSh0aUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$89","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3969180676.akira","compromised":null,"detection_total":null,"total":null},{"value":"$8a","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3575559067.akira","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSdhc0ludm9rZXInIHVpQWNjZXNzPSdmYWxzZScgLz4gICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+ICAgIDwvc2VjdXJpdHk+ICA8L3RydXN0SW5mbz48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGd+ezxpdGQ8bnRZPG90NzxwdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGh0bDxqdFw8bHQ0PHR0JDx3dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSFSRl5MQ1pZJCQ1X2kvTjc=","type":"Ansi","source":"File String Dumps","process":null,"filename":"ff86a65c3e912382c84af727d18c581c.arika","compromised":null,"detection_total":null,"total":null},{"value":"PSYmakw2NlpsPz9Bfg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8b","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2595553418.akira","compromised":null,"detection_total":null,"total":null},{"value":"PkJiKSpXIWA3bCchK3liR21xIm14PW4gI2dQc3w4PSxedjp8Zmc/cTZCSX1zZld2JQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.2154185568.akira","compromised":null,"detection_total":null,"total":null},{"value":"PlBDZHNmOH1iWi1vQ09JQGlIbmhrQWZyIU16cTQtVSwyUCRxUi18PypPfDpPXUM=","type":"Ansi","source":"File String Dumps","process":null,"filename":"3d9ea1d79275adac711df034e67c3c40.arika","compromised":null,"detection_total":null,"total":null},{"value":"P2M+OV8wP19fX3QzX19fX19tZTllX0xsXz9yZV8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_6.png","compromised":null,"detection_total":null,"total":null},{"value":"P3YnZVc6Zzg1Jj1fN2w/U2g8R1ltOkE=","type":"Ansi","source":"File String Dumps","process":null,"filename":"db082d370280373f609eedd258a317b5.arika","compromised":null,"detection_total":null,"total":null},{"value":"P3g4USJsV3NZd3o2ZlgpKi9QJEo+e0YiX2ReMV59YlM0ZkopJg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"8bef4483a3e66b6877ef0cc4ba7b8ff1.arika","compromised":null,"detection_total":null,"total":null},{"value":"QDooSS5bInk5UEY8SS08JGYua0F7Jk5DTFQn","type":"Ansi","source":"File String Dumps","process":null,"filename":"ddfa332af06cdcab2c9b9b51fadc27ac.arika","compromised":null,"detection_total":null,"total":null},{"value":"QEFeQV1BXF9e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF1b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF9e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF9eW10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF9eXVs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGs1cWwvRnJDOEtmdExXc2draFBHYVhXYlVBSFd8fl8zeSh7cEZROFY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"b400d9141a4af05e0e5b80416dde8650.arika","compromised":null,"detection_total":null,"total":null},{"value":"QFNBVEFVQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNVQVRBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNVVkFUQVVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNVVldBVEFVQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNVVldBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNVV0FWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNWQVRBVUFWSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNWQVRBVUFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNWV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFNWV0FWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFVBVEFVQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFVTVldBVEFVQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFVTVldBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFVWV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFdBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"WyoqKiBMT0cgRVJST1IgIyUwNHp1ICoqKl0gWyVzXSBbJXNdICVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MDAuNzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglUFJPR1JBTUZJTEVTJVwoeDg2KVxNaWNyb3NvZnQgT2ZmaWNlXE9mZmljZTE0XDEwMzNcT1dTSExQMTAuQ0hNKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkIHRvIGZvbGRlciBwYXJzZXJzID0gMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkIHRvIHJvb3QgZm9sZGVyIHBhcnNlcnMgPSAx","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkcyB0byBlbmNyeXB0ID0gNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwwRjc4Qjk1Ni05MDlELTQ1QjItOEI4RC0yRTVFMUQ1MjI2NDkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwxNzA1MTY2MDQ1MjU0JE1BUEZBSUxVUkUp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwxNzA1MTY2MDQ1MjU0JE9LKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcYm9vdG1ncik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuMDQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcZm91bmQuMDAwXGRpcjAwMDAuY2hrXEZsYXNoLm9jeCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuNzMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhIChDOlxMb2ctMTMtMDEtMjAyNC0wOS0xNS00MC50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuODA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbS4uYXBob3N0cmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9lcy1lc181OTUwNWI3YTA1OWY4YTZlXGFwaG9zdHJlcy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuMzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1kYXZzeW5jcHJvdmlkZXJfMzFiZjM4NTZhZDM2NGUzNV8xMC4wLjE3MTM0LjFfbm9uZV9iYmJjZjViMmIyMmFhYzVlLm1hbmlmZXN0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuNDUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhIChDOlxhbmFseXNpc1wwXGN0eF8yXGhhbmRsZXNfMDAwMDAwMDAtMDAwMDU5NzYudnhzKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuNTM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9hbS1ldF83ZDdjODVjNjU5MmY1OWE1XHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTWljcm9zb2Z0Lk5FVFxSZWRpc3RMaXN0XEFzc2VtYmx5TGlzdF80X2NsaWVudC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTWljcm9zb2Z0Lk5FVFxSZWRpc3RMaXN0XEFzc2VtYmx5TGlzdF80X2V4dGVuZGVkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9jaHIuLi11c19kNzMzY2RjNWQ2NGRkOWY4XHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuNTQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9lbi11c18wOTc3ZDI1MDIzYzY4MDAzXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMDQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTVNCdWlsZFxNaWNyb3NvZnRcV2luZG93cyBXb3JrZmxvdyBGb3VuZGF0aW9uXHYzLjVcV29ya2Zsb3cuVGFyZ2V0cyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMDQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTVNCdWlsZFxNaWNyb3NvZnRcV2luZG93cyBXb3JrZmxvdyBGb3VuZGF0aW9uXHYzLjVcV29ya2Zsb3cuVmlzdWFsQmFzaWMuVGFyZ2V0cyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My4wXFN1YnNldExpc3RcQ2xpZW50LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My41XFJlZGlzdExpc3RcRnJhbWV3b3JrTGlzdC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My41XFN1YnNldExpc3RcQ2xpZW50LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBEZWZlbmRlclxlbi1VU1xFcHBNYW5pZmVzdC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBEZWZlbmRlclxlbi1VU1xNcEFzRGVzYy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcbXB2aXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21sYXVuY2guZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcc2V0dXBfd20uZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbGF5ZXIuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcV01QTWVkaWFTaGFyaW5nLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjE0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbnNzY2kuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbnNzdWkuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcY29ubmVjdGlvbm1hbmFnZXJfZG1yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcYXZ0cmFuc3BvcnQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzEyMC5qcGcp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzQ4LmpwZyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzEyMC5wbmcp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzQ4LnBuZyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcUmVuZGVyaW5nQ29udHJvbC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcUmVuZGVyaW5nQ29udHJvbF9ETVAueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcbXB2aXMuRExMKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcU2tpbnNcUmV2ZXJ0Lndteik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFxhY2Nlc3Nvcmllc1xlbi1VU1x3b3JkcGFkLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXGVuLVVTXFRhYmxlVGV4dFNlcnZpY2UuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VBbWhhcmljLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VBcnJheS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VEYVlpLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VUaWdyaW55YS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VZaS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcSW1hZ2luZ0RldmljZXMuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcUGhvdG9BY3EuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcUGhvdG9WaWV3ZXIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxEaWFnbm9zdGljc1xDb21wcmVoZW5zaXZlXENvbXByZWhlbnNpdmUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxEaWFnbm9zdGljc1xTaW1wbGVcU2ltcGxlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5wc2QxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5Gb3JtYXQucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5wc20xKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxPcGVyYXRpb25WYWxpZGF0aW9uUmVzb3VyY2VzLnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1pY3Jvc29mdC5Qb3dlclNoZWxsLk9wZXJhdGlvbi5WYWxpZGF0aW9uLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTEuRGlhZ25vc3RpY3NcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUxLkRpYWdub3N0aWNzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjMuOTc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9wYS0uLi1wa19hNzVkMzgyYjE3ZjlmYmJmXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTIuRGlhZ25vc3RpY3NcMS4wLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUyLkRpYWdub3N0aWNzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMjk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTIuRGlhZ25vc3RpY3NcMS4wLjFcRXhhbXBsZTIuRGlhZ25vc3RpY3MucHNkMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTMuRGlhZ25vc3RpY3NcMS4xLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUzQS5EaWFnbm9zdGljcy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTMuRGlhZ25vc3RpY3NcMi4wLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUzQi5EaWFnbm9zdGljcy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VNYW5hZ2VtZW50LmZvcm1hdC5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VNYW5hZ2VtZW50LnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VQcm92aWRlckZ1bmN0aW9ucy5wc20xKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuNjQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9zci0uLi1iYV80ZGQ5Y2ZiNzdlNjllZWZiXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcQWxwaGFiZXQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcYXItU0FcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjYyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV90aS1ldF85OGU2ZDIyMDU5ZDQxNTFjXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcYmctQkdcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcQ29udGVudC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcY3MtQ1pcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZGEtREtcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZGUtREVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZWwtR1JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tR0JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcRmxpY2tMZWFybmluZ1dpemFyZC5leGUubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSW5rT2JqLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSW5wdXRQZXJzb25hbGl6YXRpb24uZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSVBTRXZlbnRMb2dNc2cuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDgxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSXBzTWlncmF0aW9uUGx1Z2luLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbWljYXV0LmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbWlwLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbXNod0xhdGluLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNccnRzY29tLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcU2hhcGVDb2xsZWN0b3IuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcdGFic2tiLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGFiVGlwLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGlwUmVzLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGlwVHNmLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXMtRVNcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXMtTVhcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXQtRUVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjk0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZmktRklcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcRmxpY2tBbmltYXRpb24uYXZpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnItQ0FcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnItRlJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWRcYXV4YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuODA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuODcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xpbnNlcnRcaW5zZXJ0YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xpbnNlcnQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTM5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRcZWEueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRca2V5cGFkYmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRca29yLWtvci54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTgwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2UueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VBbHRHcl9ydGwueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfYWx0Z3IueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfY2EueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfaGViLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDg5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfanBuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2Vfa29yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfcnRsLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGphLWpwLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGtvLWtyLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLWNoYW5namVpLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLWRheWkueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLXBob25ldGljLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tjbGVhcnVpLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tjbGVhcnVpXG9za2NsZWFydWliYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51XG9za21lbnViYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tuYXZcb3NrbmF2YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tuYXYueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWRcb3NrbnVtcGFkYmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkXG9za3ByZWRiYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXGVhLXN5bS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXGphLWpwLXN5bS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXHN5bWJhc2UueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaGUtSUxcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHItSFJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHUtSFVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjg4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdyY29tbW9ubG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdyZW5jbG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdybGF0aW5sbS5kYXQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdydXNhbG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzYXIueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdydXNhc2guZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2F0LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2hzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2h0LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY3N5LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZGFuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZGV1LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZWwueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZW4ueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZXNwLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZmluLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZnJhLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaGUueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaGkueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaHJ2LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaXRhLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzanBuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBza29yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzbmxkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzbm9yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcGxrLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcHRiLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcHRnLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcm9tLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcnVzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3JiLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3JsLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3ZlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzdHIueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDQyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXQtSVRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcamEtSlBcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtca28tS1JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcTGFuZ3VhZ2VNb2RlbFxjaHN0aWMuZGdtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbHQtTFRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbHYtTFZcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbmItTk9cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNTEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbmwtTkxcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNjgxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccGwtUExcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNjk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccHQtQlJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccHQtUFRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccm8tUk9cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccnUtUlVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc2stU0tcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc2wtU0lcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc3ItTGF0bi1SU1x0aXByZXN4LmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc3YtU0VcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1hY2NvdW50c3J0XzMxYmYzODU2YWQzNjRlMzVfMTAuMC4xNzEzNC4xX25vbmVfMWY2ZWM1NjZhMjA1NWNmOC5tYW5pZmVzdCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdGgtVEhcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdHItVFJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdWstVUFcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcemgtQ05cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcemgtVFdcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjkuMDM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxNU0luZm9cZW4tVVNcbXNpbmZvMzIuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjkuMDQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9hbS1ldF84N2QxMzAxODhkOTAxYmEwXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzAuMzgzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhICglQ09NTU9OUFJPR1JBTUZJTEVTJVxtaWNyb3NvZnQgc2hhcmVkXE9GRklDRTE0XEN1bHR1cmVzXE9GRklDRS5PREYp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcYmluXFBlc3Rlci5iYXQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcYnVpbGQucHNha2UucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcQ0hBTkdFTE9HLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfQmVmb3JlRWFjaF9BZnRlckVhY2guaGVscC50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfUGVzdGVyLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfVGVzdERyaXZlLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcVmFsaWRhdG9yXFZhbGlkYXRvci5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2gucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2guVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcVGVzdC1Bc3NlcnRpb24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvbnRleHQucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvbnRleHQuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvdmVyYWdlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvdmVyYWdlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXERlc2NyaWJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXERlc2NyaWJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEl0LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEl0LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE1vY2sucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE1vY2suVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFBlc3RlclN0YXRlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFBlc3RlclN0YXRlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24uVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3REcml2ZS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3REcml2ZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjgzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfc2hvdWxkLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjg0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfTW9ja2luZy5oZWxwLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RzUnVubmluZ0luQ2xlYW5SdW5zcGFjZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcTElDRU5TRSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcbnVuaXRfc2NoZW1hXzIuNS54c2Qp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLm51c3BlYyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLnBzbTEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUkVBRE1FLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcQ29udGV4dC5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcRGVzY3JpYmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcSXQuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVHcmVhdGVyVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVMZXNzVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQ29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTWF0Y2guc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkRXhpc3Quc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90QmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90QmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90Q29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90RXhpc3Quc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzM4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkVGhyb3cuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzM5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90TWF0Y2guc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90VGhyb3cuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcYmluXFBlc3Rlci5iYXQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcYnVpbGQucHNha2UucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQ5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcQnVpbGQuYmF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQ5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcQ0hBTkdFTE9HLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzQ5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcY2hvY29sYXRleUluc3RhbGwucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcZW4tVVNcYWJvdXRfQmVmb3JlRWFjaF9BZnRlckVhY2guaGVscC50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcZW4tVVNcYWJvdXRfTW9ja2luZy5oZWxwLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcZW4tVVNcYWJvdXRfUGVzdGVyLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcZW4tVVNcYWJvdXRfc2hvdWxkLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcZW4tVVNcYWJvdXRfVGVzdERyaXZlLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzY2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRXhhbXBsZXNcVmFsaWRhdG9yXFZhbGlkYXRvci5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzIuNjMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9oZS1pbF9mYTZlZjcyNzMxOGY0YWYzXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTcxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMaWtlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMaWtlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNTg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMaWtlRXhhY3RseS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMaWtlRXhhY3RseS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVPZlR5cGUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVPZlR5cGUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2gucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2guVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2V0LVRlc3RJbmNvbmNsdXNpdmUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcVGVzdC1Bc3NlcnRpb24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEJyZWFrQW5kQ29udGludWUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXENvbnRleHQucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXENvbnRleHQuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXENvdmVyYWdlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXERlc2NyaWJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXERlc2NyaWJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXENvdmVyYWdlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEdsb2JhbE1vY2stQS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEdsb2JhbE1vY2stQi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEluLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEluLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEl0LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXEl0LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjYyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXE1vY2sucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXE1vY2suVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFBlc3RlclN0YXRlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFBlc3RlclN0YXRlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24uVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFRlc3REcml2ZS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFRlc3REcml2ZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcTElDRU5TRSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcbnVuaXRfc2NoZW1hXzIuNS54c2Qp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcUGVzdGVyLm51c3BlYyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcRnVuY3Rpb25zXFRlc3RzUnVubmluZ0luQ2xlYW5SdW5zcGFjZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcUGVzdGVyLnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjg0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcUkVBRE1FLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcUGVzdGVyLnBzbTEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcUGVzdGVyLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcQ29udGV4dC5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcRGVzY3JpYmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcSXQuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkQmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkQmVHcmVhdGVyVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkQmVMZXNzVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkRXhpc3Quc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTWF0Y2guc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90QmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkQmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkQ29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNjk4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90QmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNzAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90Q29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNzAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90RXhpc3Quc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNzAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90TWF0Y2guc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNzAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkTm90VGhyb3cuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuNzAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy40LjBcU25pcHBldHNcU2hvdWxkVGhyb3cuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzYuOTM2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9uYi1ub19jZTk5MjJjMmUwMDMzNDMwXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDEuNjU3XSBbZmlsZV9sb2dnZXJdIFtpbmZvXSAxMzgzMDAgbXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuMzYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcU2VydmljZXNcdmVyaXNpZ24uYm1wKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuMzc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xhZG9qYXZhcy5pbmMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuMzkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xhZG92YnMuaW5jKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuMzk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xlbi1VU1xtc2FkZXIxNS5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzIwLnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzIxLnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDE5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzI1LnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzI2LnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDgzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzI3LnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDg3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzI4LnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNDk0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2FkbzYwLnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTg5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2Fkb21kMjgudGxiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2Fkb3IyOC50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGFkb1xtc2Fkb3gyOC50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXGVuLVVTXHdhYjMycmVzLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGFkY2phdmFzLmluYyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNTk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGFkY3Zicy5pbmMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNjkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGVuLVVTXG1zYWRjZXIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNjkxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGVuLVVTXG1zYWRjb3IuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNjk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGVuLVVTXG1zYWRkc3IuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNzU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGVuLVVTXG1zZGFwcnNyLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuNzcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG1zYWRjXGVuLVVTXG1zZGFyZW1yLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxlbi1VU1xtc2Rhc3Fsci5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxlbi1VU1xvbGVkYjMyci5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxlbi1VU1xzcWxvbGVkYi5ybGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxlbi1VU1xzcWx4bWx4LnJsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxvbGVkYmp2cy5pbmMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxvbGVkYnZicy5pbmMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxzcWxvbGVkYi5ybGwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcc3lzdGVtXG9sZSBkYlxzcWx4bWx4LnJsbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDIuODM4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcaW50ZXJuZXQgZXhwbG9yZXJcZW4tVVNcaG1tYXBpLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDcuNjY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcaW50ZXJuZXQgZXhwbG9yZXJcZW4tVVNcaWVpbnN0YWwuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDcuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcaW50ZXJuZXQgZXhwbG9yZXJcZW4tVVNcaWV4cGxvcmUuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDcuNjc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcaW50ZXJuZXQgZXhwbG9yZXJcaW1hZ2VzXGJpbmcuaWNvKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6NDcuNjc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglUFJPR1JBTUZJTEVTJVxLTVNwaWNvXERNLmJpbik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjA6MTguMDE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcZm91bmQuMDAwXGRpcjAwMTEuY2hrXFN0YXRlUmVwb3NpdG9yeS1NYWNoaW5lLnNyZC1zaG0p","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjA6MTguMDI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcZm91bmQuMDAwXGRpcjAwMTEuY2hrXFN0YXRlUmVwb3NpdG9yeS1NYWNoaW5lLnNyZC13YWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjA6MTguMDk4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAxMi5jaGtcdGh1bWJjYWNoZV8xNi5kYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjA6MjIuOTQyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAxMi5jaGtcdGh1bWJjYWNoZV83NjguZGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjE6MTcuNzU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVzb3VyY2VcQ01hcFxJZGVudGl0eS1IKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MjE6MTcuNzU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVzb3VyY2VcQ01hcFxJZGVudGl0eS1WKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6Mjk6MzkuNjg2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxzaGFyZVwxNzA1MTY2MDQ1MjU0JE1BUEZBSUxVUkUp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6Mjk6MzkuNjg2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxzaGFyZVwxNzA1MTY2MDQ1MjU0JE9LKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6Mjk6NDQuNjc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglU0FNUExFRElSJVwxNzA1MTY2MDQ1MjU0JE1BUEZBSUxVUkUp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6Mjk6NDQuNjc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglU0FNUExFRElSJVwxNzA1MTY2MDQ1MjU0JE9LKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6Mjk6NDkuNDc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gZmlsZSByZW5hbWUgZmFpbGVkLiBTeXN0ZW0gZXJyb3I6NSAoQzpcc2hhcmVcbmV0d29ya19vcmlnaW5hbC5wY2Fwbmcp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzA6MDQuMzYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhICglU0FNUExFRElSJVxuZXR3b3JrX29yaWdpbmFsLnBjYXBuZyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXElua09iai5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXG1pY2F1dC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXG1zaHdMYXRpbi5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXHJ0c2NvbS5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXFRhYlRpcDMyLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXFRpcFJlcy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDMuMzM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcaW5rXGVuLVVTXFRpcFRzZi5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NDguMTM4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXG1pY3Jvc29mdCBzaGFyZWRcTVNJbmZvXGVuLVVTXG1zaW5mbzMyLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTMuMjUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXFNlcnZpY2VzXHZlcmlzaWduLmJtcCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTMuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cYWRvamF2YXMuaW5jKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTMuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cYWRvdmJzLmluYyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTMuMjU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cZW4tVVNcbXNhZGVyMTUuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yMC50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yMS50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yNS50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yNi50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yNy50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG8yOC50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG82MC50bGIp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG9tZDI4LnRsYik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG9yMjgudGxiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxhZG9cbXNhZG94MjgudGxiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxlbi1VU1x3YWIzMnJlcy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xhZGNqYXZhcy5pbmMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xhZGN2YnMuaW5jKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xlbi1VU1xtc2FkY2VyLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xlbi1VU1xtc2FkY29yLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xlbi1VU1xtc2FkZHNyLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xlbi1VU1xtc2RhcHJzci5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxtc2FkY1xlbi1VU1xtc2RhcmVtci5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcZW4tVVNcbXNkYW9yYXIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcZW4tVVNcbXNkYXNxbHIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcZW4tVVNcb2xlZGIzMnIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcZW4tVVNcc3Fsb2xlZGIucmxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcZW4tVVNcc3FseG1seC5ybGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcb2xlZGJqdnMuaW5jKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcb2xlZGJ2YnMuaW5jKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcc3Fsb2xlZGIucmxsKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXHN5c3RlbVxvbGUgZGJcc3FseG1seC5ybGwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDg3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcSW50ZXJuZXQgRXhwbG9yZXJcZW4tVVNcaG1tYXBpLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDg3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcSW50ZXJuZXQgRXhwbG9yZXJcZW4tVVNcaWVpbnN0YWwuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDg4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcSW50ZXJuZXQgRXhwbG9yZXJcZW4tVVNcaWV4cGxvcmUuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzI6NTguMDg5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcSW50ZXJuZXQgRXhwbG9yZXJcaWU5cHJvcHMucHJvcGRlc2Mp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzM6NTIuNDIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglUFJPR1JBTUZJTEVTJVwoeDg2KVxKYXZhXGpyZTEuOC4wXzEzMVxsaWJcc2VjdXJpdHlcdHJ1c3RlZC5saWJyYXJpZXMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MzU6MDIuMDIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglUFJPR1JBTUZJTEVTJVwoeDg2KVxKYXZhXGpyZTEuOC4wXzE2MVxsaWJcc2VjdXJpdHlcdHJ1c3RlZC5saWJyYXJpZXMp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"XCQgSDl0JFB0I0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQgVVZXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQgVVZXQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQgVVdBVkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQgVkFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQgVldBVEFVQVZI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCRwSDlDUHQjSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8c","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3420563904.akira","compromised":null,"detection_total":null,"total":null},{"value":"XG9QVTReJWYlckk0YDMsdUYqVilQIEhOczV0O1sqJVAsVjo=","type":"Ansi","source":"File String Dumps","process":null,"filename":"a2bbd2db1ef7ec9f66ec97128c44b432.arika","compromised":null,"detection_total":null,"total":null},{"value":"$8d","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1249788089.akira","compromised":null,"detection_total":null,"total":null},{"value":"XFo/JHU7fEElIWo9PSFuZGo3J01MUDg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"65f18c22a26d786d58baf03327b3a4b6.arika","compromised":null,"detection_total":null,"total":null},{"value":"XihjVlggflxnJUcqcCws","type":"Ansi","source":"File String Dumps","process":null,"filename":"84e2aecc7b83355671e2fbb90fbfe220.arika","compromised":null,"detection_total":null,"total":null},{"value":"XixVR3QiRDg5TX1NVmBvS0llKXF2PCxGNXgwLGVTfDJQc0Jve1A/XS0=","type":"Ansi","source":"File String Dumps","process":null,"filename":"7613e2e2a85e806f604e559c483da2fa.arika","compromised":null,"detection_total":null,"total":null},{"value":"XmYhODAoL1NlfSAvdCNCVSdKUD5MQHxlXkFdXkRDJ2JIRWFzIkxQZH1m","type":"Ansi","source":"File String Dumps","process":null,"filename":"63cef36cae70c367b395dad7bbf7ae62.arika.2676194022.akira","compromised":null,"detection_total":null,"total":null},{"value":"XlV8J11rRDtvSV8=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c7d303b4c88ea75609f3ef1a14d354ba.arika","compromised":null,"detection_total":null,"total":null},{"value":"XyInIl8/IiIi","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_6.png","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZG91Ymxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZmxvYXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2lzX2RvdWJsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEFfQV5BXF9eXVs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEFfQV5BXUFcX15b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGFub255bW91cyBuYW1lc3BhY2Un","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXUFcX15b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFcX15bXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxfXls=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxfXltd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxfXl0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV9BXkFdQVxfXl1b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8e","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2674441763.akira","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGFibGVDbGFzc2Vz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBc1VzZXI=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBdFN0b3JhZ2U=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJblNoYXJlZEJyb2tlcg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGlvblR5cGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBmYW1pbHkgbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBpbiB1c2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBub3QgYXZhaWxhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURNWE1ldGFkYXRhQm90aA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURNWE1ldGFkYXRhRGV2aWNl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURNWE1ldGFkYXRhVXNlcg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QUdFOTxUJz5oRShHR1BTWA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"f3a49aa9314a41a0d662a40419857a4d.arika","compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWtpcmFfcmVhZG1lLnR4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWxyZWFkeSBjb25uZWN0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxyZWFkeSBvcGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4gZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4tZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWRhdGV0aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpbGUtbDEtMi0y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1vYnNvbGV0ZS1sMS0yLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN0cmluZy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1zZWN1cml0eS1zeXN0ZW1mdW5jdGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwSURGbGFncw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0UHJvY2Vzc1Rlcm1pbmF0aW9uTWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0VGhyZWFkSW5pdGlhbGl6YXRpb25UeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVBQUkFJU0VSUExVR0lOLkVOQUJMRUJJTlRFTEVNRVRSWQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVBQUkFJU0VSUExVR0lOLkVOQUJMRVJFR1RFTEVNRVRSWQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVBQUkFJU0VSUExVR0lOLkVOQUJMRVJVTkFQUFJBSVNFUg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVBQUkFJU0VSUExVR0lOLkVOQUJMRVRBU0tSRVBBSVI=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVBQUkFJU0VSUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbGlzdCB0b28gbG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbm90IGZvdW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgb3V0IG9mIGRvbWFpbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpby5taXNj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpby5taXNjIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpby5zeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpby5zeXN0ZW0gZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpbzo6Y3JlYXRlX2F1dG9fc2F2ZV9maWxlIGVycm9yOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXNpbzo6cmFuZG9tX2FjY2Vzc19oYW5kbGUgZXJyb3I6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXN5bmNfYWxsX3dyaXRlIGZhaWxlZDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXVzdHJhbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25DYXBhYmlsaXRpZXM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoRmlyc3REZWx0YVNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoTmV4dERlbHRhU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVVUT1VBUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8f","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.442292584.akira","compromised":null,"detection_total":null,"total":null},{"value":"QmBSM154YDYwUn0hLlxcIG1NXE9PM29odSxIfGJHV3ZHdltFXmg2a11aZ0xAbCYoR0JlJXtJUz9IfG07IHV3UCJ5bDxNTDZ6IlsvVUNNbkZ4OCI=","type":"Ansi","source":"File String Dumps","process":null,"filename":"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.1205506104.akira","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFycmF5IG5ldyBsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGV4ZWN1dG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGZpbGUgZGVzY3JpcHRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGxvY2FsZSBuYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIG1lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFkX3dlYWtfcHRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBBcnJheSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QkM/PjZ0OV5jOj4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVoYXZpb3I=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmY0NjBmYzYtNDVjNS00MTE5LWFkZDMtZTM2MWE2ZTdkNWFj","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5U2lnbmF0dXJlUG9saWN5","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJlYWtPbkluaXRpYWxpemVQcm9jZXNzRmFpbHVyZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YnJva2VuIHBpcGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnMtQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnMtYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QnVpbGRMYWJFeA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YnYvSn1FYjI4YjNsYTNdU35LPTcheDQwN10nWkV+X1MoTSk+Pj8rNCFNZjVvW058N08obX08","type":"Ansi","source":"File String Dumps","process":null,"filename":"007f5ea1e1cef11db2bc6bf336b1bbf4.arika","compromised":null,"detection_total":null,"total":null},{"value":"Yy5rYGU2d0FsayIjUiNzZiI=","type":"Ansi","source":"File String Dumps","process":null,"filename":"13d6584f187c8e91625fa906198b13c7.arika","compromised":null,"detection_total":null,"total":null},{"value":"$90","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2564684880.akira","compromised":null,"detection_total":null,"total":null},{"value":"$91","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2144647933.akira","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW9FeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2Fubm90IHN3aXRjaCBmcm9tIGF1dG9tYXRpYyB0byBtYW51YWwgYXJndW1lbnQgaW5kZXhpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2Fubm90IHN3aXRjaCBmcm9tIG1hbnVhbCB0byBhdXRvbWF0aWMgYXJndW1lbnQgaW5kZXhpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FwYWJpbGl0aWVz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2Y4MmFlY2ItZmZmZi00MDQ5LWJkNWItNjg3NzM0YTVkNTE5","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0ZHT3B0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5DYWNoZVJlc3luY0ZpbGV0aW1l","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFLkNIRUNLUFJPQ0VTUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOLkVOQUJMRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOLlBFUkNFTlRCQVRURVJZUE9XRVJUT1NUT1A=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOUE9XRVJQTEFOUkVTRVQuRU5BQkxF","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOUE9XRVJXQVRDSEVSLkVOQUJMRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0hBTkdFUE9XRVJQUk9GSUxFUExVR0lOUlVOT05CQVRURVJZLkVOQUJMRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1ob25na29uZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW1wbGlmaWVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS10cmFkaXRpb25hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hYRnRzLTFaREJeVGVZK1JOfTlkLzJRYSFgbixQXGEgZUhtRDdYZQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"7b51b37fefabca87b02d4abad955fef8.arika","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q0xFQU5EUklWRVJTVE9SRVBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xFQVJBVU9QVElPTlNQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xFQVJBVU9QVElPTlNQTFVHSU4uU0tVTElTVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHlBbGxvd0NvbUNhcGFiaWxpdHk=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHlBbGxvd0ludGVyYWN0aXZlVXNlcnM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHlBbGxvd0xvd0JveA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHlBcHBJRA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHlQYXJhbQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NX1JvU2V0dGluZ3M=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NX1VubWFyc2hhbGluZ1BvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZCBsaW5lIHRvIGFyZ3ZXIGZhaWxlZCE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZExpbmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q09NTUFORExJTkUuRU5BQkxFRFBMVUdJTlM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZExpbmVUb0FyZ3ZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXI=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXIgKHg4Nik=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVzY0MzJEaXI=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q09NUFJFU1MuU1lTVEVNUFJPRklMRUZPTERFUlM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NUFJFU1MuVVNFUlBST0ZJTEVGT0xERVJT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09ORklHVVJBVElPTlRST1VCTEVTSE9PVEVSUExVR0lOLkVOQUJMRUROU0NMRUFOVVA=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09ORklHVVJBVElPTlRST1VCTEVTSE9PVEVSUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29uaG9zdC5leGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiBhYm9ydGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiBhbHJlYWR5IGluIHByb2dyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiByZWZ1c2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiByZXNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q09SUlVQVElPTlJFUEFJUlBMVUdJTi5DQUJIQVNI","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09SUlVQVElPTlJFUEFJUlBMVUdJTi5ET1dOTE9BRFVSTA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09SUlVQVElPTlJFUEFJUlBMVUdJTi5JU0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09SUlVQVElPTlJFUEFJUlBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlIGF1dG8gc2F2ZSBmaWxlIGZhaWxlZCEgKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JlYXRlIGF1dG8gc2F2ZSBmaWxlIGZhaWxlZCEgKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmxhZ3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Jvc3MgZGV2aWNlIGxpbms=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHQgY29udGV4dCBub3QgZm91bmQhICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRuZXRQcmVGZXRjaFRyaWdnZXJQZXJpb2RTZWNvbmRz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Nyc3MuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVuY2llcw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1p5IyIqeC5tZnZbK3t6JElpYj4=","type":"Ansi","source":"File String Dumps","process":null,"filename":"1490814da9e530f51ec54831683ecd82.arika","compromised":null,"detection_total":null,"total":null},{"value":"RCIiZlQqKn47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4RDs0KHUt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4ZjlHdWZA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZCRkRDtkJGx0WQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRITDlnWHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDlEJDh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCR4SDlEJGB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RDtcJDB+Q0Uz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"REFURVRJTUVTWU5DUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGNhMDc0Y2UtNTQ3Yy00NTk1LWFlOTAtNTYyMjliOGUzYmQ5","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGRkZCwgTU1NTSBkZCwgeXl5eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdQcm9jZXNzSGVhcE9ubHk=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFJwY1N0YWNrU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLkFWQUlMQUJMRUZSRUVTUEFDRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLkVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLkVYQ0xVREVER0VPSURT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLklOQ0xVREVER0VPSURT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLlJFTU9WRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLlNIT1dDT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVMSVZFUlRPQVNUUExVR0lOLlNZU1RFTURJU0tTSVpF","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGV2aWNlIG9yIHJlc291cmNlIGJ1c3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"REVWSUNFRFJJVkVSUkVNT1ZBTFBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlRm9ybQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ01hdGNoQW55TWFzaw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5IG5vdCBlbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5X2VudHJ5OjpzdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5X2l0ZXJhdG9yOjpkaXJlY3RvcnlfaXRlcmF0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5X2l0ZXJhdG9yOjpvcGVyYXRvcisr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9GbHVzaFByb2Nlc3NOYW1lTGlzdA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNBTmFtZUNvbnN0cmFpbnRz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUhlYXBMb29rYXNpZGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1hbmRhdG9yeUJhc2ljQ29uc3RyYWludHM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVuc3VwcG9ydGVkQ3JpdGljYWxFeHRlbnNpb25z","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRTeW5jRGVsdGFUaW1l","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRElTS1NQQUNFRlJFRVRPU1RBUlRDTEVBTlVQ","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRElTS1NQQUNFRlJFRVRPU1RPUENMRUFOVVA=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFQ0JTVEVNUENMRUFOVVA=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFQ09NUEFDVE9TQklOQVJJRVM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFQ09NUFJFU1NJT05OT1NTRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFRElTTUNMRUFOVVBJTUFHRQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFSElCRVJOQVRJT04=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFT1NMT0dDTEVBTlVQ","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFUkVNT1ZFU09GVFdBUkVESVNUUklCVVRJT04=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFUkVNT1ZFU09GVFdBUkVESVNUUklCVVRJT05BQ1RJT04=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFVVNFUlBST0ZJTEVDT01QUkVTUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFVk9MVU1FQ0FDSEVTTU9ESUZJQ0FUSU9O","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFV0lORE9XU1JFU1RPUkVQT0lOVFJFTU9WQUw=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uRU5BQkxFV0lORE9XU1NFQVJDSEZJTEVSRU1PVkFM","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uTkdFTlRJTUVPVVRIT1VSUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uUkVNT1ZFTkdFTkZJTEVT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uU09GVFdBUkVESVNUUklCVVRJT05GSUxFREFZU09MRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uU1RPUkFHRVNFTlNFRU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uV0lORE9XU09MREVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RElTS0NMRUFOVVBQTFVHSU4uV0lORE9XU1NUT1JFQ0xFQU5VUEVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9sTTI6JWcwRzJQdkROWFIsaGZrYndlOHRhLSM8WzFB","type":"Ansi","source":"File String Dumps","process":null,"filename":"e657a6fe72e4018e5e574099665ac958.arika","compromised":null,"detection_total":null,"total":null},{"value":"RHBpQXdhcmVuZXNz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZHV0Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHluYW1pY0NvZGVQb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$92","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2730553688.akira","compromised":null,"detection_total":null,"total":null},{"value":"ZTBBX0FeQV1BXF0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZTBBX0FeQV1BXF9eXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZTJjOTE0MzYtOGZiMS00NDZhLTk2NTUtMzEzOTVmNDJhNzM3","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZT4yfjx1TUdAVklqelBUa2k=","type":"Ansi","source":"File String Dumps","process":null,"filename":"465ce1d315a25020498475cd0e470c2b.arika","compromised":null,"detection_total":null,"total":null},{"value":"RUdIOUdQdCBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWk6fjtnJCJUXWhfVzcxYU1cemhzaTZuIG1DLU1XZDU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"28385dac25a7fab3008c9600a790f886.arika","compromised":null,"detection_total":null,"total":null},{"value":"RWxlbWVudCBub3QgZm91bmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW1wdHkgYnVmZmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$93","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.20853543.akira","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3RyaWN0Q2hlY2tzRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2Vha1NpZ25hdHVyZUZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5kIG9mIGZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hbWVyaWNhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hdXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1iZWxpemU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYXJpYmJlYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1pcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1qYW1haWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1ueg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1zb3V0aCBhZnJpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC10cmluaWRhZCB5IHRvYmFnbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11aw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11c2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3IgbWVzc2FnZSBmaWxlIDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3Igc2hhcmVkIGZpbGUgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3JTdGF0ZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXhlY3V0YWJsZSBmb3JtYXQgZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXhwYW5kIDMyLWJ5dGUga2V4cGFuZCAxNi1ieXRlIGs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbGljaXRQc21BY3RpdmF0aW9uVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXhwbG9yZXIuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItZGlhbG9nYm94LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItd2luZG93c3RhdGlvbi1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5zaW9uUG9pbnRzUG9saWN5","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjtEJEp1VUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zl8/PD8nNFJeeTdZVWdVa1pPQzx3","type":"Ansi","source":"File String Dumps","process":null,"filename":"f6351bc71c3a1882acaa634fef3b0f9b.arika","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGZsdXNoIHRvIGZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGdldHRpbmcgdGltZXpvbmUgaW5mby4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIG9wZW5pbmcgZmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG1ha2UgZnVsbCBlbmNyeXB0ISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG1ha2UgcGFydCBlbmNyeXB0ISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG1ha2Ugc3BvdCBlbmNyeXB0ISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHJlYWQgc2hhcmUgZmlsZXMh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHdyaXRlIGhlYWRlciEgKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHdyaXRpbmcgdG8gZmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkdOT1haXF5+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSBleGlzdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBoYW5kbGUgbm90IGZvdW5kISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSByZW5hbWUgZmFpbGVkLiBTeXN0ZW0gZXJyb3I6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBzaXplIGludmFsaWQhICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZV9sb2dnZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZW5hbWUgdG9vIGxvbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxpZ2h0U2V0dGluZ3NWZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm4rJ1RPM2grMnZkYVtWKThUZ20/c1hdWyVOe3ItYkB9Lw==","type":"Ansi","source":"File String Dumps","process":null,"filename":"32b82f726d1ee58f991922a10045a43a.arika","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm9udGRydmhvc3QuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zm9yIHdyaXRpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9yZWdyb3VuZEpvYklPUHJpb3JpdHk=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9yZWdyb3VuZEpvYlRocmVhZFByaW9yaXR5","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm9ybWF0IHNwZWNpZmllciByZXF1aXJlcyBudW1lcmljIGFyZ3VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zm9ybWF0IHNwZWNpZmllciByZXF1aXJlcyBzaWduZWQgYXJndW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnF3ZWR4TWE1QyBpICpIOyguKlxXYEY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"a76061dbb7a2fd4bf0fa71de8af2dba2.arika","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlBbmRFeGl0VGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWJlbGdpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWNhbmFkaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbnRFbmRIZWFwRGVidWdPcHRpb25z","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnN9X1xNWUgwVihXZEsvRFMvOWVySnFXcSxZY2w5dHQ7PVw6","type":"Ansi","source":"File String Dumps","process":null,"filename":"74cc718391507614c9a3d103718c64bb.arika","compromised":null,"detection_total":null,"total":null},{"value":"ZnVuY3Rpb24gbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rzg7RzB8ImZm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"RztLfi42YydBO2AmIUExIjRmZzsuen0uRC4=","type":"Ansi","source":"File String Dumps","process":null,"filename":"821e793c822d49d33d4aae481ebf707e.arika","compromised":null,"detection_total":null,"total":null},{"value":"Z2JzL2FceDs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2RpU2NhbGluZw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWF1c3RyaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWxpY2h0ZW5zdGVpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0IGF1dG8gc2F2ZSBmaWxlIG5hbWUgZmFpbGVkISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0IGZpbGUgc2l6ZSBmYWlsZWQhICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QUNQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU91dHB1dENQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHluYW1pY1RpbWVab25lSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlU3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGgyVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2Y7RCRIdV9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2Y7RCRIdVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2ZmZmZmZmZI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2ZmZmZmZmZJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2ZmZmZmZmZMaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRXZlbnRDb3VudGVy","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmxhZw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z21wX2RlZmF1bHRfYWxsb2M6IFZpcnR1YWwgbWVtb3J5IGV4aGF1c3RlZC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z21wX2RlZmF1bHRfcmVhbGxvYzogVmlydHVhbCBtZW1vcnkgZXhoYXVzdGVkLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"R29sZGVuUGFydG5lcnNoaXBJZA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z3JlYXQgYnJpdGFpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z3JvdXBwb2xpY3luYW1l","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R1Y+TShkcl5ocmBlQComKWB1ZDlgJlg9LXtJSTomO1Vq","type":"Ansi","source":"File String Dumps","process":null,"filename":"e36386185e3711bbced228f9979bd739.arika","compromised":null,"detection_total":null,"total":null},{"value":"SEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGkgZnJpZW5kcyw=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"$94","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$95","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"$96","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"aG9uZy1rb25n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aG9zdCB1bnJlYWNoYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHoiZik0JUY8KSt2aj5YZjEjZVNHcmtUcFN2NXRrUHF1","type":"Ansi","source":"File String Dumps","process":null,"filename":"eeb162f84f26b66ba8f07f9bb87a7797.arika","compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllciByZW1vdmVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpdHlUeXBl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWYgeW91J3JlIGluZGVlZCBpbnRlcmVzdGVkIGluIG91ciBhc3Npc3RhbmNlIGFuZCB0aGUgc2VydmljZXMgd2UgcHJvdmlkZSB5b3UgY2FuIHJlYWNoIG91dCB0byB1cyBmb2xsb3dpbmcgc2ltcGxlIGluc3RydWN0aW9uczo=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"aWxsZWdhbCBieXRlIHNlcXVlbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5hcHByb3ByaWF0ZSBpbyBjb250cm9sIG9wZXJhdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5kZXBlbmRlbnRSZWFkZXJEaXNhYmxlZA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdCBjaXBoZXIgZmFpbGVkISAo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdCBjcnlwdG8gZmFpbGVkIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW50ZXJydXB0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBhcmd1bWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmaWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmaWxsIGNoYXJhY3RlciAneyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmb3JtYXQgc3BlY2lmaWVyIGZvciBjaGFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmb3JtYXQgc3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBoYXNoIGJ1Y2tldCBjb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzZWVr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBzZXJ2aWNlIG93bmVyLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdG9pIGFyZ3VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCB0eXBlIHNwZWNpZmllcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmJhZGJpdCBzZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmVvZmJpdCBzZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmZhaWxiaXQgc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9zdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9zdHJlYW0gc3RyZWFtIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXJpc2gtZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXMgYSBkaXJlY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNCdWlsZFVuc3VwcG9ydGVk","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNDb21tc0FwaG9zdFRlc3RIb29rRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNSZXRhaWxPUw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZENvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXRhbGlhbi1zd2lzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SiUlb1wuLnI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"akwmJlpsNjZBfj8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"SlBNRUplQmldQlFeX1woeDxkcXk+X0o=","type":"Ansi","source":"File String Dumps","process":null,"filename":"a76061dbb7a2fd4bf0fa71de8af2dba2.arika","compromised":null,"detection_total":null,"total":null},{"value":"SlIhYllJUVh3Jio5LCg9QkZ4UHBnRkEnMFheIU4=","type":"Ansi","source":"File String Dumps","process":null,"filename":"e63b7d26bac4bb3382f80a7a7af46598.arika","compromised":null,"detection_total":null,"total":null},{"value":"SnkxTil5fFJzaHhWJXpKJHBLYHYgNH5oNk0gSlAxVnA6V1lhZW99","type":"Ansi","source":"File String Dumps","process":null,"filename":"c7670fae2482d4b550841ef09da02ad8.arika","compromised":null,"detection_total":null,"total":null},{"value":"SzxpZTwqPipTcC03J2d9dXVkLDZYK1F3aEZcaHw4SGpIJFQ=","type":"Ansi","source":"File String Dumps","process":null,"filename":"0928c463e5e5624fbd3d9f0b23d52add.arika","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcCBpbiBtaW5kIHRoYXQgdGhlIGZhc3RlciB5b3Ugd2lsbCBnZXQgaW4gdG91Y2gsIHRoZSBsZXNzIGRhbWFnZSB3ZSBjYXVzZS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFjdGl2YXRpb25Db250ZXh0c0FsaXZl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCFkJChMIWQkQEQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgQTkpdkBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQgU1VWV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQgU1VWV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQgVVZXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQgVVZXQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgVkFUQVVBV0w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgVkFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgVldBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgVldBVEg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgVldBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCQgV0FUQVZI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQmOFwkJnQsOFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bCRAQV9BXUFcXg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCRQSDlMJDh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCYmamw2Nlp+Pz9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TDlsJDh0Okg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TFx0LU40RltzYkA0NWIgQX5UTlAlMk1fJzJpMHxJdCxtaDFidVo8","type":"Ansi","source":"File String Dumps","process":null,"filename":"dbf29b2e7ce0bb6aad5a8df7024dfc73.arika","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5ERVRFQ1RDT05ESVRJT05FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5GUkVFU1BBQ0VSRVFVSVJFTUVOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5NQVhSRU1PVkFMQVRURU1QVFM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5NSU5JTVVNTEFOR1BBQ0tDT1VOVFJFUVVJUkVNRU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TEFOR1VBR0VQQUNLUkVNT1ZBTFBMVUdJTi5QRVJGT1JNQUNUSU9ORU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFzdFNoZWxsUnVu","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoUGVybWlzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENfQ09MTEFURQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENfTU9ORVRBUlk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENfTlVNRVJJQw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5SW1wZXJzb25hdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlzdCBvZiBkcml2ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFVzZXJTZXR0aW5ncw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bG9DLk1aekJUVVZLZy5lNC15JkBaYQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"007f5ea1e1cef11db2bc6bf336b1bbf4.arika","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nLSVkLSVtLSVZLSVILSVNLSVT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG9nZ2VyIHdpdGggbmFtZSAn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9nb25VSS5leGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3MuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$97","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.4093858990.akira","compromised":null,"detection_total":null,"total":null},{"value":"$98","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.4266910399.akira","compromised":null,"detection_total":null,"total":null},{"value":"TV93MlhoSTt9K2ldUmUqM2MobzVQR2dcWkFNcFk=","type":"Ansi","source":"File String Dumps","process":null,"filename":"cbe848a7be7a5f807d4f31988c393758.arika","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUlk","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlUHJldmlld0J1aWxkcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlUHJldmlld0J1aWxkc1BvbGljeVZhbHVl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldCB0b28gbG9uZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsQ291bnRJbkNlcnQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ2VydENvdW50","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4RGVhZEFjdGl2YXRpb25Db250ZXh0cw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4TG9hZGVyVGhyZWFkcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVtb3J5IENvbXByZXNzaW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVyZ2VBbGdvcml0aG0=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWVzc2FnZSBzaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUdPVEZsYWdz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUlOSU1VTUlOVEVSVkFMQkVUV0VFTlNDQU5TSU5IT1VSUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluaW11bVN0YWNrQ29tbWl0SW5CeXRlcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWlua2VybmVsXGNydHNcdWNydFxpbmNcY29yZWNydF9pbnRlcm5hbF9zdHJ0b3guaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluUnNhUHViS2V5Qml0TGVuZ3Ro","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWlzc2luZyAnfScgaW4gZm9ybWF0IHN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWlzc2luZyBwcmVjaXNpb24gc3BlY2lmaWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXB6X2Rpdl9xcjogRGl2aWRlIGJ5IHplcm8u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXB6X2ltcG9ydDogTmFpbHMgbm90IHN1cHBvcnRlZC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXB6X3Bvd206IE5lZ2F0aXZlIGV4cG9uZW50IGFuZCBub24taW52ZXJ0aWJsZSBiYXNlLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXB6X3Bvd206IFplcm8gbW9kdWxvLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXVsdGlwbGUgZXhjZXB0aW9ucw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"biBpcyB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkFOKFNOQU4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmFuKHNuYW4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbLFNlY3VyaXR5PUltcGVyc29uYXRpb24gRHluYW1pYyBGYWxzZV0=","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbZXBtYXBwZXJd","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbnRzdmNzXQ==","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmUgcHJlY2lzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmUgd2lkdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmV0d29yayBkb3du","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmV0d29yayByZXNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmV0d29yayB1bnJlYWNoYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmV3LXplYWxhbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkxTIEN1cnJlbmN5IERhdGE=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm0zZTR8WT5rTGpkW01pez5RIXlbekNPSixhIWhb","type":"Ansi","source":"File String Dumps","process":null,"filename":"49d066db5c6bfd42d23b409e7eb37e77.arika","compromised":null,"detection_total":null,"total":null},{"value":"bm8gYnVmZmVyIHNwYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gY2hpbGQgcHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm8gY3B1IGF2YWlsYWJsZSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gbG9jayBhdmFpbGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gbWVzc2FnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gbWVzc2FnZSBhdmFpbGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gcHJvdG9jb2wgb3B0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3BhY2Ugb24gZGV2aWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3RyZWFtIHJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3VjaCBkZXZpY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3VjaCBkZXZpY2Ugb3IgYWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3VjaCBmaWxlIG9yIGRpcmVjdG9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm8gc3VjaCBwcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9HdWlBY2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tk9JU1lIQU1NRVJQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLWJva21hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IGEgZGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IGEgc29ja2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IGEgc3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IGFsbG93ZWQgZGlzazo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IGNvbm5lY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IGVub3VnaCBtZW1vcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tk9USUZZVVNFUkZJWElTU1VFU1BMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TlVGSS5FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnVtYmVyIGlzIHRvbyBiaWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyIG9mIHRocmVhZCB0byBmb2xkZXIgcGFyc2VycyA9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyIG9mIHRocmVhZCB0byByb290IGZvbGRlciBwYXJzZXJzID0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyIG9mIHRocmVhZHMgdG8gZW5jcnlwdCA9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnZmWFteRzhAVVE/J1dIdEIhd1QgMk4nc3E+RHZgU2EyNg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"c7921b27be802a5196f0e25a2d767f0f.arika","compromised":null,"detection_total":null,"total":null},{"value":"bzU0TXZ8eVc7XDhGZ1wldSVxSnh7IzY4emhjdmhySA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"aa60201ecad4ee62b254dda53e6c8857.arika","compromised":null,"detection_total":null,"total":null},{"value":"$99","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3876774680.akira","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0xFRjU4OUUyRURBREZGRUUxMUMzM0Q5OEFEMTAxMw==","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0aW9uIGNhbmNlbGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0aW9uIGluIHByb2dyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0aW9uIG5vdCBwZXJtaXR0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0aW9uIG5vdCBzdXBwb3J0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0aW9uIHdvdWxkIGJsb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0b3IgIiI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0b3IgY29fYXdhaXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0b3I8PT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"T1J8J1Y8VGlZQj5QPkkmOnJnQV43RH5zeD9xXmNOKiMqe0hLJGs/cEFGajo=","type":"Ansi","source":"File String Dumps","process":null,"filename":"1e796c058d62e356b07523c734204691.arika","compromised":null,"detection_total":null,"total":null},{"value":"b3duZXIgZGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cCBXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UCI5Ti8iIXR+XU5IcjkjRkQ=","type":"Ansi","source":"File String Dumps","process":null,"filename":"8c6791f09e135d2787eae8ad68148cde.arika","compromised":null,"detection_total":null,"total":null},{"value":"$9a","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3233341502.akira","compromised":null,"detection_total":null,"total":null},{"value":"UDxLT0QxLDY2KmQlIz9rKHZxNzhKfjRuTnkt","type":"Ansi","source":"File String Dumps","process":null,"filename":"ddfa332af06cdcab2c9b9b51fadc27ac.arika","compromised":null,"detection_total":null,"total":null},{"value":"UEFfQV5BXV9e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFfQV5BXUFcX15b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cEFfQV5BXUFcX15b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzTmV0d29ya1BhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGVybWlzc2lvbiBkZW5pZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVybWlzc2lvbnM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGlsb3RJbmZvUmluZw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEluKF18bG5WdihwYVUsfl85SGl2XD9CZ34=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c8a7e3654ac759e5976fd0537e0b9924.arika","compromised":null,"detection_total":null,"total":null},{"value":"UG9saWN5VHlwZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cG9ydHVndWVzZS1icmF6aWxpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG93ZXJzaGVsbC5leGUgLUNvbW1hbmQgIkdldC1XbWlPYmplY3QgV2luMzJfU2hhZG93Y29weSB8IFJlbW92ZS1XbWlPYmplY3Qi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHIgY2hpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHItY2hpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJlY2lzaW9uIGlzIG5vdCBpbnRlZ2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJlY2lzaW9uIG5vdCBhbGxvd2VkIGZvciB0aGlzIGFyZ3VtZW50IHR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkU2VydmVyQml0bmVzcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01pdGlnYXRpb25Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0dXBJbmZvcm1hdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbURhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGlyICh4ODYp","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbVc2NDMyRGly","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHJvdG9jb2wgZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJvdG9jb2wgbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHVlcnRvLXJpY28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UUB6JkojUXd0MllTemlUVWMxa2leSjU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"33f1efd55f8716d29c66d42fa8a242ac.arika","compromised":null,"detection_total":null,"total":null},{"value":"UWUlW09gJSd0Ri98","type":"Ansi","source":"File String Dumps","process":null,"filename":"f6423058838ae7319baa54c9f2120664.arika","compromised":null,"detection_total":null,"total":null},{"value":"UVR7aXxAWlg5aWZ+M2BjMXRiVi9ZXHBfbzswXD02Ww==","type":"Ansi","source":"File String Dumps","process":null,"filename":"b6461adf958028bddf1cfb28dc7f2e0b.arika","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVldWVVc2VyQVBD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFjU2FtcGxlTnVtYmVy","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVhZCBvbmx5IGZpbGUgc3lzdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UkVCT09UUkVNRURJQVRJT04uRk9SQ0VEUkVCT09URU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVCT09UUkVNRURJQVRJT04uRk9SQ0VEUkVCT09UVE9MRVJBTkNFREFZUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVCT09UUkVNRURJQVRJT04uSUdOT1JBQkxFUkVBU09OUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVCT09UUkVNRURJQVRJT05QTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVmcmVzaEFmdGVy","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnS2V5UGF0aFJlZGlyZWN0","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVy","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVyTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uQ0hFQ0tQUk9DRVNT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uRU5BQkxF","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uRU5BQkxFUlVOT05CQVRURVJZ","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uTUlOSU1VTU1JTlVURVNCRVRXRUVOUE9XRVJXQVRDSEVSU0NBTg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uTUlOVVRFSU5URVJWQUxTRU5ESU5HRVZFTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uUEVSQ0VOVEJBVFRFUllQT1dFUlRPU1RPUA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVRVUVTVFNMRUVQREVGRVJSQUxQTFVHSU4uUE9XRVJXQVRDSEVSU0NBTlJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVzb3VyY2UgZGVhZGxvY2sgd291bGQgb2NjdXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVzb3VyY2UgdW5hdmFpbGFibGUgdHJ5IGFnYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmVzdHJpY3Qo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVzdWx0IG91dCBvZiByYW5nZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV0aHJvd2luZyB1bmtub3duIGV4Y2VwdGlvbiBpbiBsb2dnZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV0dXJuVmFsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmcqYGhkIWpfSkMzRm4yazdQJDkkSkghKj4qMGxTNGd7THBOLmhCI3s7Kj0rXg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"c296cd35d2f45e3f4c93ffa16140d11b.arika","compromised":null,"detection_total":null,"total":null},{"value":"Um1FbmRTZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um1HZXRMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um1SZWdpc3RlclJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um1TaHV0ZG93bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um1TdGFydFNlc3Npb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9Jbml0aWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Uk9PVFxDSU1WMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Uk9URmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnBjRXhjZXB0aW9uRmlsdGVyTW9kZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjUnVudGltZUNvbmZpZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cnNQczc7NTE+TFtUXTQgOlxPSj5ALGFx","type":"Ansi","source":"File String Dumps","process":null,"filename":"e0ab6679f54a95168d634f7a8952f5f6.arika","compromised":null,"detection_total":null,"total":null},{"value":"UnN0cnRNZ3IuRExM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsUGNUb0ZpbGVIZWFkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5kRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnVuQmluYXJ5Q29udHJvbEhvc3RQcm9jZXNzSW5TZXBhcmF0ZUFwcENvbnRhaW5lcg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$9b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"cyBXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"UzdpYVlDUiFcajQjST8gcHohOD1QLE1HSHZ2XA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"4693c292253ca448687098647bbcd539.arika","compromised":null,"detection_total":null,"total":null},{"value":"$9c","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.4196251165.akira","compromised":null,"detection_total":null,"total":null},{"value":"$9d","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.666507834.akira","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c0N1cnJlbmN5T3ZlcnJpZGU=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VhcmNoIGZpbGVzIGVycm9yOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoUGF0aE1vZGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoVUkuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk9SW1wZXJzb25hdGlvbiBEeW5hbWljIEZhbHNl","type":"Unicode","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlEZXNjcmlwdG9y","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlQcm92aWRlcnM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRlVQREFURS5DQUJIQVNI","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRlVQREFURS5ET1dOTE9BRFVSTA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRlVQREFURS5FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRlVQREFURS5QQUNLQUdFVkVSU0lPTg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRlVQREFURS5QQVlMT0FESEFTSA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwdGVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVyVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZSBhbHJlYWR5IGV4aXN0cy4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0VSVklDRS5LSUxM","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VSVklDRS5NQVhJTVVNQllURVM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VSVklDRS5TS0lQVkVSSUZZVEFTSw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZURsbA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZURsbFVubG9hZE9uU3RvcA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZU1haW4=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZU1hbmlmZXN0","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZVBhcmFtZXRlcnM=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VydmljZXMuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5kT2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tBWlVSRUFESk9JTkVERU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tCQVRURVJZUE9XRVJFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tERVZJQ0VXVURJU0FCTEVEUkVHSVNUUlk=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tET01BSU5FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tFRFVDQVRJT05TS1U=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tFTlRFUlBSSVNFU0tV","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tGRUFUVVJFVVBEQVRFU1BBVVNFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tIT01FU0tV","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tJTlRVTkVNQU5BR0VERU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tNRVRFUkVETkVUV09SS0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tQUk9TS1U=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tRVUFMSVRZVVBEQVRFU1BBVVNFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuQ0hFQ0tWT0xVTUVMSUNFTlNFRU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuRU5BQkxFRVZFTlREUklWRU5SRU1FRElBVElPTlM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuRU5BQkxFTEVHQUNZUkVNRURJQVRJT05T","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuR0xBU1NCUkVBS0NIRUNLRU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuTUlOSU1VTU1JTlVURVNCRVRXRUVOUE9XRVJXQVRDSEVSU0NBTg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuTUlOSU1VTU1JTlVURVNCRVRXRUVOU0hFTExSVU5T","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuTUlOSU1VTVRJTUVCRVRXRUVOU0hFTExTQ0FOU0lOSE9VUlM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuTkVXT1M=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuUEVSQ0VOVEJBVFRFUllQT1dFUg==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuUE9XRVJXQVRDSEVSU0NBTlJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuUVVBTElUWVVQREFURUNPT0xJTkdQRVJJT0REQVlT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuUVVJRVRQRVJJT0REQVlT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuU0NDTQ==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuU1RPUkFHRVNFTlNFVEFTS0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuU1RPUkFHRVNFTlNFVEFTS1RIUkVTSE9MRE9WRVJSSURFSU5EQVlT","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuVVBNQU5BR0VE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuVVNPU0NBTkVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuV1NBVVRPVVBEQVRFRU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwuWkVST0VYSEFVU1Q=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2h1dGRvd25GbGFncw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0lISEVBTFRIUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2lob3N0LmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c291dGggYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgga29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgtYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgta29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1hcmdlbnRpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ib2xpdmlh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jaGlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb3N0YSByaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1kb21pbmljYW4gcmVwdWJsaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lY3VhZG9y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lbCBzYWx2YWRvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ndWF0ZW1hbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ob25kdXJhcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tZXhpY2Fu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tb2Rlcm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1uaWNhcmFndWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYW5hbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYXJhZ3VheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wZXJ1","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wdWVydG8gcmljbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC11cnVndWF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC12ZW5lenVlbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3Bvb2xzdi5leGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1JQVHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREFUQVNUT1JFVVBMT0FEU0laRUxJTUlU","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVMRVRFQklUU0RPV05MT0FERVJGT0xERVJFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVMRVRFREFUQVNUT1JFRk9MREVSRU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVMRVRFRE9SRUdLRVlFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVMRVRFRE9XTkxPQURGT0xERVJFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVMRVRFVVBEQVRFU1RPUkVGT0xERVJFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uREVURUNUQ09ORElUSU9ORU5BQkxFRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uSU5URVJWQUw=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uSU5URVJWQUxCRVRXRUVOUlVOU0lOREFZUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uTENVSU5TVEFMTERBVEVEQVlTVEhSRVNIT0xE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uTENVT1NCVUlMRENIRUNL","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uTUFYREFZU1RPQ09OU0lERVJPRkZMSU5F","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uTUFYVVBMT0FEQVRURU1QVFM=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uT09CRURBWVNUSFJFU0hPTEQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uT1NJTlNUQUxMREFURURBWVNUSFJFU0hPTEQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uUEVSRk9STUFDVElPTkVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uUkVTRVRFTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uUk9MTEJBQ0tDT1VOVENIRUNL","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uUk9MTEJBQ0tPU0JVSUxEQ0hFQ0s=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uU0NBTlNUQVJWQVRJT05JTkRBWVNUSFJFU0hPTEQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uU0NBTlNUQVJWQVRJT05USFJFU0hPTEQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBQ0tEQVRBUkVTRVRQTFVHSU4uVVBMT0FEREFUQVNUT1JFVE9XQVRTT05FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RhdGUgbm90IHJlY292ZXJhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RvaSBhcmd1bWVudCBvdXQgb2YgcmFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFLkZPREhFTExPRkFDRVJFQ0dOSVRJT05SRU1PVkFM","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFLkZPRE1JWEVEUkVBTElUWVJFTU9WQUw=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFLlJFU1RPUkVQT0lOVFJFTU9WQUxQTFVHSU4=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFLlNZU1RFTURSSVZFQ09NUFJFU1NQTFVHSU4=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFLlVTRVJET1dOTE9BREZPTERFUkNMRUFOVVBQTFVHSU4=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RPUkFHRVNFTlNFUExVR0lOUy5NQVhJTVVNQlVJTEROVU1CRVI=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RyZWFtIHRpbWVvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHBvaW50ZXIgaXMgbnVsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1VWV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1VWV0FUQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1VWV0FWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1ZBVEFVQVZBV0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1ZXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1ZXQVRBVUFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3dlZGlzaC1maW5sYW5k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtIElkbGUgUHJvY2Vzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtIFZvbHVtZSBJbmZvcm1hdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtQ3JpdGljYWw=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dCQgVVdBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgVVdBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgVVdBVkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgV0FUQVVBVkFX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgV0FWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgV0FWRTM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQgV0hjXCQwMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCQoPH10OTw6dDVM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCRASDtROHZI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCRcc0xjKWszQExrZ2lDKSE9QHZ0ekZwXTxTYW0hYTpUMHNoKyVJeHJePHBHUDt3N0YvfWA4fW5ZLlEvXmRqKlBbeTwkd2p1UGpIMT8gLX0+PzwgSSdTRjdgbQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"477911e3121daeda4eed90982f890fb0.arika.1770754112.akira","compromised":null,"detection_total":null,"total":null},{"value":"dCRgZkQ5K3QkSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dCRIQV9BXkFdQVxf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGVsZW1ldHJ5T3ZlcnJpZGU=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGVzdEZsYWdz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGV4dCBmaWxlIGJ1c3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhlIGRlc2NyaXB0b3IgZG9lcyBub3QgZml0IGludG8gdGhlIHNlbGVjdCBjYWxsJ3MgZmRfc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBpcyBsb2NhbCBkaXNrOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBpcyBuZXR3b3JrIGRpc2s6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBpcyBuZXR3b3JrIHBhdGg6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGhyZWFkIHBvb2wgc2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGhyZWFkLmVudHJ5X2V2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGhyZWFkLmV4aXRfZXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5n","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGh1cnNkYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGltZWQgb3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9rZW5TaXpl","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dG9vIG1hbnkgZmlsZXMgb3Blbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG9vIG1hbnkgZmlsZXMgb3BlbiBpbiBzeXN0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG9vIG1hbnkgbGlua3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dG9vIG1hbnkgc3ltYm9saWMgbGluayBsZXZlbHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2luZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tBY3RpdmF0aW9uQ29udGV4dFJlbGVhc2Vz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlbmQgTWljcm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHJpbmlkYWQgJiB0b2JhZ28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dHlmRDkgdHNI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSBEZXNjcmlwdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VSIwcVV6JUJRb25FKzBSJSUsJndFfg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"68f899e50ac479b17223ff9c277910ed.arika","compromised":null,"detection_total":null,"total":null},{"value":"$9e","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.107669243.akira","compromised":null,"detection_total":null,"total":null},{"value":"dThoW1lHW1JvOFshO3RFM0AudnAmJFpXQlN2TS8n","type":"Ansi","source":"File String Dumps","process":null,"filename":"2aac9fe79cd97459c8971481579b0d9b.arika","compromised":null,"detection_total":null,"total":null},{"value":"VV1EJSpqR1spUG06ayMhRn1RMmkzew==","type":"Ansi","source":"File String Dumps","process":null,"filename":"b51ce608eaef5605ecc77895d1068718.arika","compromised":null,"detection_total":null,"total":null},{"value":"VUFUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$9f","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2895471299.akira","compromised":null,"detection_total":null,"total":null},{"value":"dURMXjpxKEN4Qm9rIDVNSm1iSjwwSkFxVThgWWF7Mi1nIGs9JCkgMi9aTyonX31AVl5tPV1UVUxR","type":"Ansi","source":"File String Dumps","process":null,"filename":"7cbc323ea6432cee3459da0f00ed6ec1.arika.3323859166.akira","compromised":null,"detection_total":null,"total":null},{"value":"dWUhVCQoSCFUJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dW5pc3RhY2tzdmNncm91cA==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLWtpbmdkb20=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLXN0YXRlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dW5rbm93biBlcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5rbm93biBleGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dW5rbm93biBmb3JtYXQgc3BlY2lmaWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2FkRXZlbnRUcmFjZURlcHRo","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dW5tYXRjaGVkICd9JyBpbiBmb3JtYXQgc3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dW5vcmRlcmVkX21hcC9zZXQgdG9vIGxvbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFQVBQTElDQUJJTElUWUZJWEVSUExVR0lOLkVOQUJMRUVESVRJT05JREZJWA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFQVBQTElDQUJJTElUWUZJWEVSUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFQklOQVJZSEVBTFRIUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFU0VBUkNIRVJQTFVHSU4uTUFYSU1VTVJVTkNPVU5U","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFU0VSVklDRUhFQUxUSFBMVUdJTi5FTkFCTEVTRVJWSUNFSEFSREVOSU5H","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFU0VSVklDRUhFQUxUSFBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFU0VSVklDRUhFQUxUSFBMVUdJTi5TRVJWSUNFSEFSREVOSU5HVEhSRVNIT0xEREFZUw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFU0VSVklDRUhFQUxUSFBMVUdJTi5TRVJWSUNFSU5TVEFMTEJJVE1BUA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBEQVRFVEFTS0hFQUxUSFBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVBHUkFERUZVTk5FTFBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRmlsdGVy","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSW1wZXJzb25hdGVkRGV2aWNlTWFw","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlTGVnYWN5REJMb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlcmVudkRlYnVnTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5DSEVDS19JRl9GRUFUVVJFX1VQREFURV9PRkZFUkVEX0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5JTlRFUkFDVElWRV9TQ0FOX0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5NQVhJTVVNUlVOQ09VTlQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5TQ0FOX0VOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5TQ0FOX1RIUkVTSE9MRF9DSEVDS19FTkFCTEVE","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNPU0NBTlBMVUdJTi5TQ0FOU1RBUlZBVElPTlRIUkVTSE9MRA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNWV0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVNWV0FWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVRGLTE2TEVVTklDT0RF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVZBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVZXQVRBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVdBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVdBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXhJOXVodE1I","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$a0","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1350744551.akira","compromised":null,"detection_total":null,"total":null},{"value":"dix4LnoufC5+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VjZFPmAiKDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmFsdWUgdG9vIGxhcmdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yIHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VldBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"VldBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"d14hTipRbjYkRHdmRXtxbzN7VyVQJlFsZ3c0KGBla29dVWg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"af08614b515c643d8e8a34d9c8af6fba.arika","compromised":null,"detection_total":null,"total":null},{"value":"V0EoNCpGNyY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c296cd35d2f45e3f4c93ffa16140d11b.arika","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0FUQVVBVkFXRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0FUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBQWxsRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eUZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbFNoYTI1NkFsbG93","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlBZnRlclRpbWU=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JzYVB1YktleVRpbWU=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxGbGFncw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5QWZ0ZXJUaW1l","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5RmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5U2hhMjU2QWxsb3c=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2VkbmVzZGF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2VsbCwgZm9yIG5vdyBsZXQncyBrZWVwIGFsbCB0aGUgdGVhcnMgYW5kIHJlc2VudG1lbnQgdG8gb3Vyc2VsdmVzIGFuZCB0cnkgdG8gYnVpbGQgYSBjb25zdHJ1Y3RpdmUgZGlhbG9ndWUuIFdlJ3JlIGZ1bGx5IGF3YXJlIG9mIHdoYXQgZGFtYWdlIHdlIGNhdXNlZCBieSBsb2NraW5nIHlvdXIgaW50ZXJuYWwgc291cmNlcy4gQXQgdGhlIG1vbWVudCwgeW91IGhhdmUgdG8ga25vdzo=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"V2hhdGV2ZXIgd2hvIHlvdSBhcmUgYW5kIHdoYXQgeW91ciB0aXRsZSBpcyBpZiB5b3UncmUgcmVhZGluZyB0aGlzIGl0IG1lYW5zIHRoZSBpbnRlcm5hbCBpbmZyYXN0cnVjdHVyZSBvZiB5b3VyIGNvbXBhbnkgaXMgZnVsbHkgb3IgcGFydGlhbGx5IGRlYWQsIGFsbCB5b3VyIGJhY2t1cHMgLSB2aXJ0dWFsLCBwaHlzaWNhbCAtIGV2ZXJ5dGhpbmcgdGhhdCB3ZSBtYW5hZ2VkIHRvIHJlYWNoIC0gYXJlIGNvbXBsZXRlbHkgcmVtb3ZlZC4gTW9yZW92ZXIsIHdlIGhhdmUgdGFrZW4gYSBncmVhdCBhbW91bnQgb2YgeW91ciBjb3Jwb3JhdGUgZGF0YSBwcmlvciB0byBlbmNyeXB0aW9uLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2lkdGggaXMgbm90IGludGVnZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJfUHJvY2Vzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJfUHJvY2Vzc1N0YXJ0dXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0lORE9XU1NFVFVQSUdOT1JFQ09NUEFUV0FSTklOR1NTSElNLkVOQUJMRUQ=","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0lORE9XU1VQREFURUVORFBPSU5UUExVR0lOLk1BWElNVU1SVU5DT1VOVA==","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2luaW5pdC5leGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2lubG9nb24uZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V05ldEdldENvbm5lY3Rpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3JpdGVfZW5jcnlwdF9pbmZvIGVycm9yOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3JvbmcgcHJvdG9jb2wgdHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1RTQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1RTRW51bWVyYXRlUHJvY2Vzc2VzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1RTRnJlZU1lbW9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1Z9a345d2B4","type":"Ansi","source":"File String Dumps","process":null,"filename":"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika","compromised":null,"detection_total":null,"total":null},{"value":"eCBBVEFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"eCBBVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"eCVvSiUuclwu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"eCp8VFshekQlMFdZT3FyVFtATHMtdEx4ayYzPlI6Ow==","type":"Ansi","source":"File String Dumps","process":null,"filename":"33f1efd55f8716d29c66d42fa8a242ac.arika","compromised":null,"detection_total":null,"total":null},{"value":"WDEzeCNZbUdNK1BNeWtzOiQ1WjB7fE9gLm9rTlxbIzhScTh9OHozT08=","type":"Ansi","source":"File String Dumps","process":null,"filename":"8855d95beadbfe940193e0961a9d1711.arika","compromised":null,"detection_total":null,"total":null},{"value":"eD5bLDZTOFAxaz48e0E0eHYmSGl7UFZ+UF8+","type":"Ansi","source":"File String Dumps","process":null,"filename":"e0ab6679f54a95168d634f7a8952f5f6.arika","compromised":null,"detection_total":null,"total":null},{"value":"WEFfQV5BXUFcXls=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"WEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$a1","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.4287610775.akira","compromised":null,"detection_total":null,"total":null},{"value":"eHhvSiUlclwuLiQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"eHpbczRFVV95fSdHI3tFTl47ZXp1ZFVtcTU8Inc7Yn1DaHEvaCclNCpBQVt7bTojdF9FKm1p","type":"Ansi","source":"File String Dumps","process":null,"filename":"32e1c243d9f529f6b1572a76e9e3a1b1.arika.1104565937.akira","compromised":null,"detection_total":null,"total":null},{"value":"eH5iWV96SCww","type":"Ansi","source":"File String Dumps","process":null,"filename":"5fb96d4a889b98fac774672d3d01945d.arika","compromised":null,"detection_total":null,"total":null},{"value":"eTJ5J0hoUiNLcSouQHxwP3ZlU3tLS3R0ak9C","type":"Ansi","source":"File String Dumps","process":null,"filename":"db082d370280373f609eedd258a317b5.arika","compromised":null,"detection_total":null,"total":null},{"value":"WTt9VzhaY1UxNzooITpfOG8=","type":"Ansi","source":"File String Dumps","process":null,"filename":"7b647b3fc5604977780d212cc5884a2b.arika","compromised":null,"detection_total":null,"total":null},{"value":"eXogOEsyPytyejptUSMoIEA3UkNr","type":"Ansi","source":"File String Dumps","process":null,"filename":"b51ce608eaef5605ecc77895d1068718.arika","compromised":null,"detection_total":null,"total":null},{"value":"WkkqL2stTSwlKk8wMiJPPTZJOGpPNkw2Ln5MI3tPa0w/bF80YzRwMSVp","type":"Ansi","source":"File String Dumps","process":null,"filename":"266396b641c849dd72fe2c9de058f8ed.arika","compromised":null,"detection_total":null,"total":null},{"value":"WlFKMHYjbyE7eGJeO0l1QCQ=","type":"Ansi","source":"File String Dumps","process":null,"filename":"449fa81e9f40488de06c56cde5364fd8.arika","compromised":null,"detection_total":null,"total":null},{"value":"e2NSLUBkcnF3enE+RENmNHt0UjgqbDBjfnM=","type":"Ansi","source":"File String Dumps","process":null,"filename":"992bad68439ea6ed9cef7d0fb42d4dfa.arika","compromised":null,"detection_total":null,"total":null},{"value":"e30gW3t9KHt9KV0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"fCQgQDhvKHRGSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"fCQgQVRBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"fCQgVUFUQVVBVkFXSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"fCQgVUFWQVdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"IXgtc3lzLWRlZmF1bHQtbG9jYWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyUmKDM4OkhKTFBTVVZYWlxeYGNlZmtzeH0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$a2","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1221958341.akira","compromised":null,"detection_total":null,"total":null},{"value":"JFJlY3ljbGUuQmlu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJFQ1lDTEUuQklO","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWMwempuU3YkJ3R9ZysoS0ZCLjlLKDcpb0U=","type":"Ansi","source":"File String Dumps","process":null,"filename":"28385dac25a7fab3008c9600a790f886.arika","compromised":null,"detection_total":null,"total":null},{"value":"$a3","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2006426956.akira","compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVccmVtcGxcc2VkcGx1Z2lucy5kbGw=","type":"Unicode","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVktJW0tJWQgJUg6JU06JVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"J3pOYzhOZWs6cWhATWEkRUhyd1NLTzJzQi5ofW45QQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"bfaf6734393b3852e4fe5790557b1648.arika","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$a4","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3946409587.akira","compromised":null,"detection_total":null,"total":null},{"value":"KEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwgYmVnaW4pIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEZ1bGwpIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFBhcnQpIENpcGhlciBlcnJvcjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$a5","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.209225444.akira","compromised":null,"detection_total":null,"total":null},{"value":"LWhAanI1cic6XW8hUExVeU4/c0s0Vy1PR29cT3R+U2p7Xl54SWFIJA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"0f13fcd5c1b4cf4867c64cef38493ee0.arika","compromised":null,"detection_total":null,"total":null},{"value":"LWxvY2Fsb25seQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVV9DcnRfbmV3X2RlbGV0ZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWN0eXBlX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0V4Y2VwdGlvblB0cl9zdGF0aWNAVmJhZF9hbGxvY0BzdGRAQEA/QTB4NmUwMmVmZTVAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0V4Y2VwdGlvblB0cl9zdGF0aWNAVmJhZF9leGNlcHRpb25Ac3RkQEBAP0EweDZlMDJlZmU1QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0lvc2JASEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFVfRGlyX2VudW1faW1wbEBmaWxlc3lzdGVtQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFVfUmVjdXJzaXZlX2Rpcl9lbnVtX2ltcGxAZmlsZXN5c3RlbUBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JGJhc2ljX2ZpbGVfc2lua0BWbXV0ZXhAc3RkQEBAc2lua3NAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JGJhc2ljX3JhbmRvbV9hY2Nlc3NfaGFuZGxlQFZhbnlfaW9fZXhlY3V0b3JAYXNpb0BAQHdpbmRvd3NAYXNpb0BAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFY/JHdpbmNvbG9yX3N0ZG91dF9zaW5rQFVjb25zb2xlX211dGV4QGRldGFpbHNAc3BkbG9nQEBAc2lua3NAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZsb2dnZXJAc3BkbG9nQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZ0aHJlYWRfcG9vbEBhc2lvQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmoyQFZUaHJlYWRQb29sQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwN0B0aHJlYWRfcG9vbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwQUBAaW9fY29udGV4dEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZXhlY3V0b3JfdHlwZUBWPyRhbGxvY2F0b3JAWEBzdGRAQCQwQUBAdGhyZWFkX3Bvb2xAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZmlsZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZmlsZWJ1ZkBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaWZzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmluZ3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAVj8kYWxsb2NhdG9yQF9XQDJAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBEJDBCUEVAVj8kYWxsb2NhdG9yQERAc3RkQEBAdjlAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBEJDBQS0BWPyRhbGxvY2F0b3JAREBzdGRAQEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBIJDBCUEVAVj8kYWxsb2NhdG9yQEhAc3RkQEBAdjlAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfbWVtb3J5X2J1ZmZlckBJJDBDQUBWPyRhbGxvY2F0b3JASUBzdGRAQEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb2ZzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb3N0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBWPyRhbGxvY2F0b3JAX1dAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQERAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQEhAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYnVmZmVyQElAZGV0YWlsQHY5QGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQ19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQ19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY2FuY2VsbGF0aW9uX2hhbmRsZXJAVmlvY3Bfb3BfY2FuY2VsbGF0aW9uQHdpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBERFVfTWJzdGF0ZXRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMDBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMERMSktNS0FBQEBzdGRAQEBjaHJvbm9Ac3RkQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMERPSUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAVj8kZHVyYXRpb25AX0pVPyRyYXRpb0AkMDAkMFBFQ0VBQEBzdGRAQEBjaHJvbm9Ac3RkQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDAwQHN0ZEBAQGNocm9ub0BzdGRAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBETEpLTUtBQUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBET0lAQHN0ZEBAQGNocm9ub0BzdGRAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZWxhcHNlZF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQFY/JGR1cmF0aW9uQF9KVT8kcmF0aW9AJDAwJDBQRUNFQUBAc3RkQEBAY2hyb25vQHN0ZEBAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZudWxsX3JlYWN0b3JAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZzY2hlZHVsZXJAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZ3aW5faW9jcF9oYW5kbGVfc2VydmljZUBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZXhlY3V0aW9uX2NvbnRleHRfc2VydmljZV9iYXNlQFZ3aW5faW9jcF9pb19jb250ZXh0QGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kRl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZnVuY0BVdGhyZWFkX2Z1bmN0aW9uQHRocmVhZF9wb29sQGFzaW9AQEB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kZnVuY0BVdGhyZWFkX2Z1bmN0aW9uQHdpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQEB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kSV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kaXRlcmF0b3JfYnVmZmVyQFY/JGJhY2tfaW5zZXJ0X2l0ZXJhdG9yQFY/JGJhc2ljX21lbW9yeV9idWZmZXJARCQwUEtAVj8kYWxsb2NhdG9yQERAc3RkQEBAdjlAZm10QEBAc3RkQEBEVWJ1ZmZlcl90cmFpdHNAZGV0YWlsQHY5QGZtdEBAQGRldGFpbEB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbGV2ZWxfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbGV2ZWxfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbmFtZV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbmFtZV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX2dldEBfV1Y/JGlzdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBEVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcGlkX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcGlkX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kUl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kUl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kU19mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kU19mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfZmlsZW5hbWVfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfZmlsZW5hbWVfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfbGV2ZWxfZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc2hvcnRfbGV2ZWxfZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2ZpbGVuYW1lX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2ZpbGVuYW1lX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2Z1bmNuYW1lX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2Z1bmNuYW1lX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xpbmVudW1fZm9ybWF0dGVyQFVudWxsX3Njb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xpbmVudW1fZm9ybWF0dGVyQFZzY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xvY2F0aW9uX2Zvcm1hdHRlckBVbnVsbF9zY29wZWRfcGFkZGVyQGRldGFpbHNAc3BkbG9nQEBAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc291cmNlX2xvY2F0aW9uX2Zvcm1hdHRlckBWc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kVF9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kVF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdF9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVm51bGxfcmVhY3RvckBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVnNjaGVkdWxlckBkZXRhaWxAYXNpb0BAQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVndpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEBAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdHlwZWlkX3dyYXBwZXJAVndpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQEBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdl9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdl9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kd2luY29sb3Jfc2lua0BVY29uc29sZV9tdXRleEBkZXRhaWxzQHNwZGxvZ0BAQHNpbmtzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kd2luY29sb3Jfc3Rkb3V0X3NpbmtAVWNvbnNvbGVfbXV0ZXhAZGV0YWlsc0BzcGRsb2dAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kWV9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kWV9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kel9mb3JtYXR0ZXJAVW51bGxfc2NvcGVkX3BhZGRlckBkZXRhaWxzQHNwZGxvZ0BAQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kel9mb3JtYXR0ZXJAVnNjb3BlZF9wYWRkZXJAZGV0YWlsc0BzcGRsb2dAQEBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9FeGNlcHRpb25QdHJfbm9ybWFsQD9BMHg2ZTAyZWZlNUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9GYWNldF9iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeTJAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9SZWZfY291bnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmFnZ3JlZ2F0ZV9mb3JtYXR0ZXJAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9jYXN0QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGVjdXRvckBleGVjdXRpb25AYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF93ZWFrX3B0ckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNhbmNlbGxhdGlvbl9oYW5kbGVyX2Jhc2VAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNoX2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvZGVjdnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbG9yX3N0YXJ0X2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbG9yX3N0b3BfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmVycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhY2V0QGxvY2FsZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZpbGVzeXN0ZW1fZXJyb3JAZmlsZXN5c3RlbUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZsYWdfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdF9lcnJvckB2OUBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdHRlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZ1bGxfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZ1bmNfYmFzZUB3aW5fdGhyZWFkQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfYXJndW1lbnRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfc2VydmljZV9vd25lckBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlvc19iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2dlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm1pc2NfY2F0ZWdvcnlAZGV0YWlsQGVycm9yQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm11bHRpcGxlX2V4Y2VwdGlvbnNAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm5vbmNvcHlhYmxlQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm51bGxfcmVhY3RvckBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhdHRlcm5fZm9ybWF0dGVyQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlckBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlcl90YXNrQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNlcnZpY2VAZXhlY3V0aW9uX2NvbnRleHRAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNlcnZpY2VfYWxyZWFkeV9leGlzdHNAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNpbmtAc2lua3NAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNwZGxvZ19leEBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfaW50ZXJmYWNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfd2luN0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX2ludGVyZmFjZUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX3dpbjdAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9jYXRlZ29yeUBkZXRhaWxAYXNpb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnRocmVhZF9jb250ZXh0QGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVndpbl9pb2NwX2hhbmRsZV9zZXJ2aWNlQGRldGFpbEBhc2lvQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVndpbl9pb2NwX2lvX2NvbnRleHRAZGV0YWlsQGFzaW9AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"LlxvRnM5YixsM0AiQXd8S0BRZjVkNzg+W34=","type":"Ansi","source":"File String Dumps","process":null,"filename":"19a1ce0a17637330562bac2838d89751.arika","compromised":null,"detection_total":null,"total":null},{"value":"LkRgKF5zfUw8QFIqeT9CeDwtdF1zOX0+czZCckA9ZS00R3IyPE9l","type":"Ansi","source":"File String Dumps","process":null,"filename":"6a9cf9e066bc4c0d99a76bf63ab54ffd.arika","compromised":null,"detection_total":null,"total":null},{"value":"L0R7ezt6WXRsRHl7WmV6JQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"a9c9d466d235f1a4356a673056a7cad6.arika","compromised":null,"detection_total":null,"total":null},{"value":"MDQyZWEyMTQtODMwYy01OTc5LTg2ZjUtMjhmZDkyYzgwZjMw","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDRhNDkwZDQtODRjNi00OTIwLTljMjItNTFjODA4MjVmZjJj","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDRlY2NmOGUtODQ5MC00YWQxLThlZDUtMGFlNzc1MGU2OWU2","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MGJkMTk5MDktZWI2Zi00YjE2LTgwNzQtNmRjZTgwM2YwOTFk","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MS4gRGVhbGluZyB3aXRoIHVzIHlvdSB3aWxsIHNhdmUgQSBMT1QgZHVlIHRvIHdlIGFyZSBub3QgaW50ZXJlc3RlZCBpbiBydWluaW5nIHlvdXIgZmluYW5jaWFsbHkuIFdlIHdpbGwgc3R1ZHkgaW4gZGVwdGggeW91ciBmaW5hbmNlLCBiYW5rICYgaW5jb21lIHN0YXRlbWVudHMsIHlvdXIgc2F2aW5ncywgaW52ZXN0bWVudHMgZXRjLiBhbmQgcHJlc2VudCBvdXIgcmVhc29uYWJsZSBkZW1hbmQgdG8geW91LiBJZiB5b3UgaGF2ZSBhbiBhY3RpdmUgY3liZXIgaW5zdXJhbmNlLCBsZXQgdXMga25vdyBhbmQgd2Ugd2lsbCBndWlkZSB5b3UgaG93IHRvIHByb3Blcmx5IHVzZSBpdC4gQWxzbywgZHJhZ2dpbmcgb3V0IHRoZSBuZWdvdGlhdGlvbiBwcm9jZXNzIHdpbGwgbGVhZCB0byBmYWlsaW5nIG9mIGEgZGVhbC4=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8u","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":0,"total":91},{"value":"MTI1NjM4NzUtYjI3YS0xMWVlLTljMmEtMDgwMDI3Y2NiOWFm","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a6","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3040952710.akira","compromised":null,"detection_total":null,"total":null},{"value":"MWYiaTooLm1iI0twLUE9OSVwNkFJZ0Z3KW91PVhAdWkgODxPbzIgOjU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"c4230ef51e48c3575bae17f9a5db1a64.arika","compromised":null,"detection_total":null,"total":null},{"value":"Mi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4=","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"Mi4gUGF5aW5nIHVzIHlvdSBzYXZlIHlvdXIgVElNRSwgTU9ORVksIEVGRk9SVFMgYW5kIGJlIGJhY2sgb24gdHJhY2sgd2l0aGluIDI0IGhvdXJzIGFwcHJveGltYXRlbHkuIE91ciBkZWNyeXB0b3Igd29ya3MgcHJvcGVybHkgb24gYW55IGZpbGVzIG9yIHN5c3RlbXMsIHNvIHlvdSB3aWxsIGJlIGFibGUgdG8gY2hlY2sgaXQgYnkgcmVxdWVzdGluZyBhIHRlc3QgZGVjcnlwdGlvbiBzZXJ2aWNlIGZyb20gdGhlIGJlZ2lubmluZyBvZiBvdXIgY29udmVyc2F0aW9uLiBJZiB5b3UgZGVjaWRlIHRvIHJlY292ZXIgb24geW91ciBvd24sIGtlZXAgaW4gbWluZCB0aGF0IHlvdSBjYW4gcGVybWFuZW50bHkgbG9zZSBhY2Nlc3MgdG8gc29tZSBmaWxlcyBvciBhY2NpZGVudGx5IGNvcnJ1cHQgdGhlbSAtIGluIHRoaXMgY2FzZSB3ZSB3b24ndCBiZSBhYmxlIHRvIGhlbHAu","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MjViOTlhNGMtMmY4MC00ZmNkLTk4MmQtNjljZDFmNzdiYWRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MmBxQT1gRkllIT9WeXBVRzU1MmZJZS8oUE5TJVJjZzVXd1JRQA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"bffefc39245ad7926b2499b5e39c1e75.arika","compromised":null,"detection_total":null,"total":null},{"value":"MmNicHxJeXk5InFXZ3U1N1lhLFs8cFplKF13TDY2Izl9JFZ1MTM=","type":"Ansi","source":"File String Dumps","process":null,"filename":"bb8ca3cd12aa5af1e61fe68e340721e3.arika","compromised":null,"detection_total":null,"total":null},{"value":"$a7","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.1717193171.akira","compromised":null,"detection_total":null,"total":null},{"value":"MmtvbGxwajV6M3o2MzZiYWQub25pb24uNS4gV2UncmUgbW9yZSB0aGFuIG5lZ290aWFibGUgYW5kIHdpbGwgZGVmaW5pdGVseSBmaW5kIHRoZSB3YXkgdG8gc2V0dGxlIHRoaXMgcXVpY2tseSBhbmQgcmVhY2ggYW4gYWdyZWVtZW50IHdoaWNoIHdpbGwgc2F0aXNmeSBib3RoIG9mIHVzLklmIHlvdSdyZSBpbmRlZWQgaW50ZXJlc3RlZCBpbiBvdXIgYXNzaXN0YW5jZSBhbmQgdGhlIHNlcnZpY2VzIHdlIHByb3ZpZGUgeW91IGNhbiByZWFjaCBvdXQgdG8gdXMgZm9sbG93aW5nIHNpbXBsZSBpbnN0cnVjdGlvbnM6MS4gSW5zdGFsbCBUT1IgQnJvd3NlciB0byBnZXQgYWNjZXNzIHRvIG91ciBjaGF0IHJvb20gLSBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy9kb3dubG9hZC8uMi4gUGFzdGUgdGhpcyBsaW5rIC0gaHR0cHM6Ly9ha2lyYWxrenh6cTJkc3J6c3J2YnIyeGdiYnUyd2dzbXhyeWQ0Y3NnZmFtZWc1Mm43ZWZ2cjJpZC5vbmlvbi4zLiBVc2UgdGhpcyBjb2RlIC0gMTQ5Ny1QTi1MSVBYLVZMVEIgLSB0byBsb2cgaW50byBvdXIgY2hhdC5LZWVwIGluIG1pbmQgdGhhdCB0aGUgZmFzdGVyIHlvdSB3aWxsIGdldCBpbiB0b3VjaCwgdGhlIGxlc3MgZGFtYWdlIHdlIGNhdXNlLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":0,"total":182},{"value":"Mkt8aDNQLVxheS5fJClxTE84N19kR0Zk","type":"Ansi","source":"File String Dumps","process":null,"filename":"4e0b2678720cbea7115590fd585dcb1d.arika","compromised":null,"detection_total":null,"total":null},{"value":"MnhrWElCPitlM15FKGx1PFxrQihRd2ssO24tPmc9Vi1ATSc=","type":"Ansi","source":"File String Dumps","process":null,"filename":"4efc119d14b62a4f100a0b56433829d8.arika","compromised":null,"detection_total":null,"total":null},{"value":"Mnh9JipWX2E6dHUuVT5hdyx+QTdFeSY7PEFzRWxlVXNKKSA8","type":"Ansi","source":"File String Dumps","process":null,"filename":"6e34fe71c6b2a5b4463de32229cc7fac.arika","compromised":null,"detection_total":null,"total":null},{"value":"My4gVGhlIHNlY3VyaXR5IHJlcG9ydCBvciB0aGUgZXhjbHVzaXZlIGZpcnN0LWhhbmQgaW5mb3JtYXRpb24gdGhhdCB5b3Ugd2lsbCByZWNlaXZlIHVwb24gcmVhY2hpbmcgYW4gYWdyZWVtZW50IGlzIG9mIGEgZ3JlYXQgdmFsdWUsIHNpbmNlIE5PIGZ1bGwgYXVkaXQgb2YgeW91ciBuZXR3b3JrIHdpbGwgc2hvdyB5b3UgdGhlIHZ1bG5lcmFiaWxpdGllcyB0aGF0IHdlJ3ZlIG1hbmFnZWQgdG8gZGV0ZWN0IGFuZCB1c2VkIGluIG9yZGVyIHRvIGdldCBpbnRvLCBpZGVudGlmeSBiYWNrdXAgc29sdXRpb25zIGFuZCB1cGxvYWQgeW91ciBkYXRhLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"My4gVXNlIHRoaXMgY29kZSAtIDE0OTctUE4tTElQWC1WTFRCIC0gdG8gbG9nIGludG8gb3VyIGNoYXQu","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"MzdlYzBmMzUtMDI2ZS01ZTdlLWQzZDQtODBmMzI1NDdiZmZm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NC4gQXMgZm9yIHlvdXIgZGF0YSwgaWYgd2UgZmFpbCB0byBhZ3JlZSwgd2Ugd2lsbCB0cnkgdG8gc2VsbCBwZXJzb25hbCBpbmZvcm1hdGlvbi90cmFkZSBzZWNyZXRzL2RhdGFiYXNlcy9zb3VyY2UgY29kZXMgLSBnZW5lcmFsbHkgc3BlYWtpbmcsIGV2ZXJ5dGhpbmcgdGhhdCBoYXMgYSB2YWx1ZSBvbiB0aGUgZGFya21hcmtldCAtIHRvIG11bHRpcGxlIHRocmVhdCBhY3RvcnMgYXQgb25lcy4gVGhlbiBhbGwgb2YgdGhpcyB3aWxsIGJlIHB1Ymxpc2hlZCBpbiBvdXIgYmxvZyAtIGh0dHBzOi8vYWtpcmFsMml6NmE3cWdkM2F5cDNsNnl1Yjd4eDJ1ZXA3NmlkazN1MmtvbGxwajV6M3o2MzZiYWQub25pb24u","type":"Ansi","source":"Dropped File","process":null,"filename":"akira_readme.txt","compromised":null,"detection_total":null,"total":null},{"value":"NDAyNWQxOTItMjczZC00MmVjLWJkZjgtOTQwZWMzNGVlZGNh","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a8","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3813450109.akira","compromised":null,"detection_total":null,"total":null},{"value":"NTA5YjAwOWItZDhlYi00ZjdkLWExMmItYTIzMjE4YmZjYTg0","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWhHSVZaODdvKycvbVN2MmU/LX1AaURWNDlCRGQnJWFmTA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"c4230ef51e48c3575bae17f9a5db1a64.arika","compromised":null,"detection_total":null,"total":null},{"value":"N2FjNWViNzEtM2M1MS01MDg5LTFiNGUtODdhNDZiZDZiNGRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2ZjYjk3OTEtZjQ4MS00NmQxLTg0NmUtMmViNmYwMDNjNGQz","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a9","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2181991362.akira","compromised":null,"detection_total":null,"total":null},{"value":"ODI1NWQ0NmYtMjg4MS00NzUzLTg1NjctMGQxOTYyOGY4OGU0","type":"Ansi","source":"Runtime Data","process":"sedsvc.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODNhOTI3N2EtZDJmYy00YjM0LWJmODEtOGNlYjQ0MDc4MjRm","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OEFfQV5BXUFcX15dWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"OWE1NWQ5NTMtYmMyNy00NDMwLWEyNDgtNmRhMjRmMmU5OWI3","type":"Ansi","source":"Runtime Data","process":"svchost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OW9QKnZjZiE9Ri1pWExvKGUlSUk9QG1+O3pGcGhn","type":"Ansi","source":"File String Dumps","process":null,"filename":"19a1ce0a17637330562bac2838d89751.arika","compromised":null,"detection_total":null,"total":null},{"value":"OnN2STI8VGxsPEd9OWdyJzFXVT9ILHQ0LyN7fVpq","type":"Ansi","source":"File String Dumps","process":null,"filename":"4693c292253ca448687098647bbcd539.arika","compromised":null,"detection_total":null,"total":null},{"value":"$aa","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3790783025.akira","compromised":null,"detection_total":null,"total":null},{"value":"$ab","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3969180676.akira","compromised":null,"detection_total":null,"total":null},{"value":"$ac","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.3575559067.akira","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSdhc0ludm9rZXInIHVpQWNjZXNzPSdmYWxzZScgLz4gICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+ICAgIDwvc2VjdXJpdHk+ICA8L3RydXN0SW5mbz48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"$ad","type":"Ansi","source":"File String Dumps","process":null,"filename":"akira_readme.txt.2595553418.akira","compromised":null,"detection_total":null,"total":null},{"value":"PkJiKSpXIWA3bCchK3liR21xIm14PW4gI2dQc3w4PSxedjp8Zmc/cTZCSX1zZld2JQ==","type":"Ansi","source":"File String Dumps","process":null,"filename":"3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika.2154185568.akira","compromised":null,"detection_total":null,"total":null},{"value":"PlBDZHNmOH1iWi1vQ09JQGlIbmhrQWZyIU16cTQtVSwyUCRxUi18PypPfDpPXUM=","type":"Ansi","source":"File String Dumps","process":null,"filename":"3d9ea1d79275adac711df034e67c3c40.arika","compromised":null,"detection_total":null,"total":null},{"value":"P3g4USJsV3NZd3o2ZlgpKi9QJEo+e0YiX2ReMV59YlM0ZkopJg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"8bef4483a3e66b6877ef0cc4ba7b8ff1.arika","compromised":null,"detection_total":null,"total":null},{"value":"QDooSS5bInk5UEY8SS08JGYua0F7Jk5DTFQn","type":"Ansi","source":"File String Dumps","process":null,"filename":"ddfa332af06cdcab2c9b9b51fadc27ac.arika","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF1b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF9eW10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXF9eXVs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFfQV5BXUFcX15d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGs1cWwvRnJDOEtmdExXc2draFBHYVhXYlVBSFd8fl8zeSh7cEZROFY=","type":"Ansi","source":"File String Dumps","process":null,"filename":"b400d9141a4af05e0e5b80416dde8650.arika","compromised":null,"detection_total":null,"total":null},{"value":"WyoqKiBMT0cgRVJST1IgIyUwNHp1ICoqKl0gWyVzXSBbJXNdICVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"win.exe","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MDAuNzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhICglUFJPR1JBTUZJTEVTJVwoeDg2KVxNaWNyb3NvZnQgT2ZmaWNlXE9mZmljZTE0XDEwMzNcT1dTSExQMTAuQ0hNKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkIHRvIGZvbGRlciBwYXJzZXJzID0gMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkIHRvIHJvb3QgZm9sZGVyIHBhcnNlcnMgPSAx","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNDUxXSBbZmlsZV9sb2dnZXJdIFtpbmZvXSBOdW1iZXIgb2YgdGhyZWFkcyB0byBlbmNyeXB0ID0gNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwwRjc4Qjk1Ni05MDlELTQ1QjItOEI4RC0yRTVFMUQ1MjI2NDkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwxNzA1MTY2MDQ1MjU0JE1BUEZBSUxVUkUp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlwxNzA1MTY2MDQ1MjU0JE9LKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTEuNTA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcYm9vdG1ncik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuMDQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoQzpcZm91bmQuMDAwXGRpcjAwMDAuY2hrXEZsYXNoLm9jeCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuNzMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhIChDOlxMb2ctMTMtMDEtMjAyNC0wOS0xNS00MC50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTMuODA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbS4uYXBob3N0cmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9lcy1lc181OTUwNWI3YTA1OWY4YTZlXGFwaG9zdHJlcy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuMzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1kYXZzeW5jcHJvdmlkZXJfMzFiZjM4NTZhZDM2NGUzNV8xMC4wLjE3MTM0LjFfbm9uZV9iYmJjZjViMmIyMmFhYzVlLm1hbmlmZXN0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuNDUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhIChDOlxhbmFseXNpc1wwXGN0eF8yXGhhbmRsZXNfMDAwMDAwMDAtMDAwMDU5NzYudnhzKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTUuNTM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9hbS1ldF83ZDdjODVjNjU5MmY1OWE1XHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTWljcm9zb2Z0Lk5FVFxSZWRpc3RMaXN0XEFzc2VtYmx5TGlzdF80X2NsaWVudC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTWljcm9zb2Z0Lk5FVFxSZWRpc3RMaXN0XEFzc2VtYmx5TGlzdF80X2V4dGVuZGVkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuMjkwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9jaHIuLi11c19kNzMzY2RjNWQ2NGRkOWY4XHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MTYuNTQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9lbi11c18wOTc3ZDI1MDIzYzY4MDAzXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMDQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTVNCdWlsZFxNaWNyb3NvZnRcV2luZG93cyBXb3JrZmxvdyBGb3VuZGF0aW9uXHYzLjVcV29ya2Zsb3cuVGFyZ2V0cyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMDQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcTVNCdWlsZFxNaWNyb3NvZnRcV2luZG93cyBXb3JrZmxvdyBGb3VuZGF0aW9uXHYzLjVcV29ya2Zsb3cuVmlzdWFsQmFzaWMuVGFyZ2V0cyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My4wXFN1YnNldExpc3RcQ2xpZW50LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My41XFJlZGlzdExpc3RcRnJhbWV3b3JrTGlzdC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcUmVmZXJlbmNlIEFzc2VtYmxpZXNcTWljcm9zb2Z0XEZyYW1ld29ya1x2My41XFN1YnNldExpc3RcQ2xpZW50LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBEZWZlbmRlclxlbi1VU1xFcHBNYW5pZmVzdC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMTU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBEZWZlbmRlclxlbi1VU1xNcEFzRGVzYy5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcbXB2aXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21sYXVuY2guZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcc2V0dXBfd20uZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbGF5ZXIuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcV01QTWVkaWFTaGFyaW5nLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjE0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbnNzY2kuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcZW4tVVNcd21wbnNzdWkuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcY29ubmVjdGlvbm1hbmFnZXJfZG1yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcYXZ0cmFuc3BvcnQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzEyMC5qcGcp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzQ4LmpwZyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzEyMC5wbmcp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcRE1SXzQ4LnBuZyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcUmVuZGVyaW5nQ29udHJvbC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcTWVkaWEgUmVuZGVyZXJcUmVuZGVyaW5nQ29udHJvbF9ETVAueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcbXB2aXMuRExMKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBNZWRpYSBQbGF5ZXJcU2tpbnNcUmV2ZXJ0Lndteik=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFxhY2Nlc3Nvcmllc1xlbi1VU1x3b3JkcGFkLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXGVuLVVTXFRhYmxlVGV4dFNlcnZpY2UuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VBbWhhcmljLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VBcnJheS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjUzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VEYVlpLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VUaWdyaW55YS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4Nilcd2luZG93cyBudFx0YWJsZXRleHRzZXJ2aWNlXFRhYmxlVGV4dFNlcnZpY2VZaS50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcSW1hZ2luZ0RldmljZXMuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcUGhvdG9BY3EuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93cyBQaG90byBWaWV3ZXJcZW4tVVNcUGhvdG9WaWV3ZXIuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuMzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxEaWFnbm9zdGljc1xDb21wcmVoZW5zaXZlXENvbXByZWhlbnNpdmUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxEaWFnbm9zdGljc1xTaW1wbGVcU2ltcGxlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5wc2QxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5Gb3JtYXQucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDAyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvbi5wc20xKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxPcGVyYXRpb25WYWxpZGF0aW9uUmVzb3VyY2VzLnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1pY3Jvc29mdC5Qb3dlclNoZWxsLk9wZXJhdGlvbi5WYWxpZGF0aW9uLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjEuNDI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTEuRGlhZ25vc3RpY3NcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUxLkRpYWdub3N0aWNzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjMuOTc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9wYS0uLi1wa19hNzVkMzgyYjE3ZjlmYmJmXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTIuRGlhZ25vc3RpY3NcMS4wLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUyLkRpYWdub3N0aWNzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMjk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTIuRGlhZ25vc3RpY3NcMS4wLjFcRXhhbXBsZTIuRGlhZ25vc3RpY3MucHNkMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTMuRGlhZ25vc3RpY3NcMS4xLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUzQS5EaWFnbm9zdGljcy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwxLjAuMVxUZXN0XE1vZHVsZXNcRXhhbXBsZTMuRGlhZ25vc3RpY3NcMi4wLjFcRGlhZ25vc3RpY3NcU2ltcGxlXEV4YW1wbGUzQi5EaWFnbm9zdGljcy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VNYW5hZ2VtZW50LmZvcm1hdC5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VNYW5hZ2VtZW50LnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuMzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwxLjAuMC4wXFBhY2thZ2VQcm92aWRlckZ1bmN0aW9ucy5wc20xKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjYuNjQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9zci0uLi1iYV80ZGQ5Y2ZiNzdlNjllZWZiXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcQWxwaGFiZXQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcYXItU0FcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjYyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcYW1kNjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV90aS1ldF85OGU2ZDIyMDU5ZDQxNTFjXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcYmctQkdcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcQ29udGVudC54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcY3MtQ1pcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzIxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZGEtREtcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZGUtREVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZWwtR1JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tR0JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuMzk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcRmxpY2tMZWFybmluZ1dpemFyZC5leGUubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSW5rT2JqLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSW5wdXRQZXJzb25hbGl6YXRpb24uZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSVBTRXZlbnRMb2dNc2cuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDgxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcSXBzTWlncmF0aW9uUGx1Z2luLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNDg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbWljYXV0LmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbWlwLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcbXNod0xhdGluLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNccnRzY29tLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcU2hhcGVDb2xsZWN0b3IuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcdGFic2tiLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGFiVGlwLmV4ZS5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGlwUmVzLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTM5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZW4tVVNcVGlwVHNmLmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNTU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXMtRVNcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXMtTVhcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZXQtRUVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNjk0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZmktRklcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcRmxpY2tBbmltYXRpb24uYXZpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnItQ0FcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnItRlJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuNzk2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWRcYXV4YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuODA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuODcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xpbnNlcnRcaW5zZXJ0YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xpbnNlcnQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTM5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRcZWEueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRca2V5cGFkYmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWRca29yLWtvci54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjcuOTgwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2UueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VBbHRHcl9ydGwueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfYWx0Z3IueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfY2EueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfaGViLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMDg5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfanBuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2Vfa29yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGJhc2VfcnRsLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGphLWpwLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXGtvLWtyLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLWNoYW5namVpLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLWRheWkueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluXHpoLXBob25ldGljLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tjbGVhcnVpLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tjbGVhcnVpXG9za2NsZWFydWliYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51XG9za21lbnViYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTgyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tuYXZcb3NrbmF2YmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMTk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tuYXYueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWRcb3NrbnVtcGFkYmFzZS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkXG9za3ByZWRiYXNlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXGVhLXN5bS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXGphLWpwLXN5bS54bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzXHN5bWJhc2UueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaGUtSUxcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHItSFJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHUtSFVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjg4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdyY29tbW9ubG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdyZW5jbG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdybGF0aW5sbS5kYXQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMjk5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdydXNhbG0uZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzAzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzYXIueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaHdydXNhc2guZGF0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2F0LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2hzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY2h0LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzY3N5LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZGFuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZGV1LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZWwueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZW4ueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZXNwLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZmluLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzZnJhLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaGUueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaGkueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaHJ2LnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzMyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaWQueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzaXRhLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzanBuLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBza29yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzbmxkLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzbm9yLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcGxrLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcHRiLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguMzkzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcHRnLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcm9tLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzcnVzLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDA4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3JiLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDEwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3JsLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDE3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzc3ZlLnhtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDE4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXBzdHIueG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDQyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcaXQtSVRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcamEtSlBcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtca28tS1JcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcTGFuZ3VhZ2VNb2RlbFxjaHN0aWMuZGdtbCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbHQtTFRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbHYtTFZcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNDc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbmItTk9cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNTEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcbmwtTkxcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNjgxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccGwtUExcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNjk1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccHQtQlJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccHQtUFRcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccm8tUk9cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtccnUtUlVcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzI4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc2stU0tcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzM1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc2wtU0lcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc3ItTGF0bi1SU1x0aXByZXN4LmRsbC5tdWkp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcc3YtU0VcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1hY2NvdW50c3J0XzMxYmYzODU2YWQzNjRlMzVfMTAuMC4xNzEzNC4xX25vbmVfMWY2ZWM1NjZhMjA1NWNmOC5tYW5pZmVzdCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdGgtVEhcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdHItVFJcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcdWstVUFcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzc5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcemgtQ05cdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjguNzg1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxpbmtcemgtVFdcdGlwcmVzeC5kbGwubXVpKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjkuMDM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJUNPTU1PTlBST0dSQU1GSUxFUyVcbWljcm9zb2Z0IHNoYXJlZFxNU0luZm9cZW4tVVNcbXNpbmZvMzIuZXhlLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MjkuMDQwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBzaXplIGludmFsaWQhIChDOlxmb3VuZC4wMDBcZGlyMDAwMS5jaGtcd293NjRfbWljcm9zb2Z0LXdpbmRvd3MtbWNjcy1zeW5jcmVzLnJlc291cmNlc18zMWJmMzg1NmFkMzY0ZTM1XzEwLjAuMTcxMzQuMV9hbS1ldF84N2QxMzAxODhkOTAxYmEwXHN5bmNyZXMuZGxsLm11aSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzAuMzgzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gR2V0IGZpbGUgc2l6ZSBmYWlsZWQhICglQ09NTU9OUFJPR1JBTUZJTEVTJVxtaWNyb3NvZnQgc2hhcmVkXE9GRklDRTE0XEN1bHR1cmVzXE9GRklDRS5PREYp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcYmluXFBlc3Rlci5iYXQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcYnVpbGQucHNha2UucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjIwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcQ0hBTkdFTE9HLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfQmVmb3JlRWFjaF9BZnRlckVhY2guaGVscC50eHQp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfUGVzdGVyLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfVGVzdERyaXZlLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjMzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjM0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcQ2FsY3VsYXRvclxBZGQtTnVtYmVycy5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjM3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRXhhbXBsZXNcVmFsaWRhdG9yXFZhbGlkYXRvci5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVHcmVhdGVyVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVMZXNzVGhhbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQmVOdWxsT3JFbXB0eS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjQ4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbi5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcQ29udGFpbkV4YWN0bHkuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcRXhpc3QuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2gucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjUyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2guVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcTWF0Y2hFeGFjdGx5LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcUGVzdGVyVGhyb3cuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcU2hvdWxkLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEFzc2VydGlvbnNcVGVzdC1Bc3NlcnRpb24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjU5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvbnRleHQucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvbnRleHQuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvdmVyYWdlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXENvdmVyYWdlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjYzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXERlc2NyaWJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXERlc2NyaWJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEluTW9kdWxlU2NvcGUuVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEl0LnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXEl0LlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjY5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE1vY2sucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE1vY2suVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjcyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXE5ldy1GaXh0dXJlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjczXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFBlc3RlclN0YXRlLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFBlc3RlclN0YXRlLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24ucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFNldHVwVGVhcmRvd24uVGVzdHMucHMxKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3REcml2ZS5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3REcml2ZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjc4XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjgzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfc2hvdWxkLmhlbHAudHh0KQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNjg0XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcZW4tVVNcYWJvdXRfTW9ja2luZy5oZWxwLnR4dCk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RSZXN1bHRzLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcRnVuY3Rpb25zXFRlc3RzUnVubmluZ0luQ2xlYW5SdW5zcGFjZS5UZXN0cy5wczEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzA5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcTElDRU5TRSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcbnVuaXRfc2NoZW1hXzIuNS54c2Qp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzExXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLm51c3BlYyk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLnBzZDEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLnBzbTEp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzEzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUGVzdGVyLlRlc3RzLnBzMSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzE1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcUkVBRE1FLm1kKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcQ29udGV4dC5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcRGVzY3JpYmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIyXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcSXQuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzIzXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI1XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVHcmVhdGVyVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI2XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI3XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQmVMZXNzVGhhbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkQ29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzI5XSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTWF0Y2guc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkRXhpc3Quc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMwXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90QmVOdWxsT3JFbXB0eS5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90QmUuc25pcHBldHMucHMxeG1sKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzMxXSBbZmlsZV9sb2dnZXJdIFtlcnJvcl0gRmlsZSBoYW5kbGUgbm90IGZvdW5kISAoJVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcMy4zLjVcU25pcHBldHNcU2hvdWxkTm90Q29udGFpbi5zbmlwcGV0cy5wczF4bWwp","type":"Ansi","source":"Dropped File","process":null,"filename":"Log-13-01-2024-09-15-40.txt","compromised":null,"detection_total":null,"total":null},{"value":"WzIwMjQtMDEtMTMgMDk6MTg6MzEuNzM0XSBbZmlsZ